Skip to main content

Configure Firewall on an Edge Router

Firewall rules are configured on Edge Routers.

An IP Set is a group of IP addresses to which Firewall rules are applied. Grouping IP addresses into an IP Set allows you to avoid creating a separate rule for each IP address.

  1. Create an IP Set.
  2. Create a firewall rule.

1. Create an IP Set

  1. From the control panel, open the Cloud Director panel: in the top menu, click Products → VMware-based Cloud → the Cloud Director section.
  2. Open the virtual data center page.
  3. Go to the Networking → Edges section.
  4. Open the page of the required Edge.
  5. Click Services.
  6. Open the Grouping object → IP Sets tab.
  7. Click +.
  8. Enter a group name.
  9. Enter IP addresses or IP ranges.
  10. Click Keep.

2. Create a firewall rule

If the firewall is enabled, the default rule for ingress traffic will block all traffic until you configure other rules.

  1. From the control panel, open the Cloud Director panel: in the top menu, click Products → VMware-based Cloud → the Cloud Director section.

  2. Open the virtual data center page.

  3. Go to the Networking → Edges section.

  4. Open the page of the required Edge.

  5. Click Services.

  6. Open the Firewall tab.

  7. Turn on the Enabled switch.

  8. Click +.

  9. Enter a rule name.

  10. In the Source field, click + and enter the source address.

  11. In the Service field, select any.

  12. In the Action field, select Accept.

  13. To specify destination objects to which the rule will be applied, in the Destination field click +, in the Browse objects of type field select the destination object type, add the necessary objects, and click KEEP. Available object types:

    • Gateway interfaces — all internal networks (Internal), all external networks (External), or all external and internal networks (Any);
    • Virtual machines — virtual machines;
    • OrgVdcNetworks — organization-level networks;
    • IP Sets — groups of IP addresses;
    • Security Groups — security groups.

  14. Click Save changes.

Rule examples

To allow internet access via any protocol to a server with a specified IP:

  1. From the control panel, open the Cloud Director panel: in the top menu, click Products → VMware-based Cloud → the Cloud Director section.
  2. Open the virtual data center page.
  3. Go to the Networking → Edges section.
  4. Open the page of the required Edge.
  5. Click Services.
  6. Open the Firewall tab.
  7. Turn on the Enabled switch.
  8. Click +.
  9. Enter a rule name.
  10. In the Source field, click IP and enter the IP address.
  11. In the Destination field, select Any.
  12. In the Service field, select Any.
  13. In the Action field, select Accept.
  14. Click Save changes.