Protect your server with the UserGate VE firewall

Last update: October 05 2026Open in Markdown

1. Link the firewall server and the protected server.
2. Check the interfaces.
3. Configure the local interface on the firewall.
4. Configure the NAT rule.
5. Configure filtering rules.

1. Link the firewall server and the protected server

The organization of connectivity to the protected infrastructure depends on where the firewall is deployed — on a cloud server or on a virtual machine in a VMware-based public or private cloud.

Cloud server

1. If you need to protect a cloud server, a Managed Kubernetes cluster, or a Managed Databases cluster in the same project as the firewall, add the firewall server to the project's private network. For different projects in the same pool, configure access to the private network across projects.

2. If you need to protect a cloud server, a Managed Kubernetes cluster, or a Managed Databases cluster located in a different pool, or a dedicated server, colocation server, or virtual machine in VMware-based Cloud, use the Selectel global router.

Cloud powered by VMware

1. Optional: if you do not have a private subnet in the data center where the firewall is deployed, or you want to use a new one, create a new private subnet. When creating a subnet:

   • select the first address of the subnet as the gateway. When entering IP range, exclude the selected gateway address;
   • as Secondary DNS, specify the Selectel DNS server 188.93.16.19.

2. In the control panel, in the top menu, click Products and select VMware-based Cloud.

3. Go to the Cloud Director section.

4. Open the virtual data center page → the Virtual Machines section.

5. Open the virtual machine page.

6. Go to the Hardware → NICs section.

7. Click Edit.

8. Click ADD NETWORK TO VAPP.

9. In the Type field, select Routed.

10. In the table, select a private subnet. If you need to protect virtual machines in the same data center as the firewall, you can connect them to the same private network. For different data centers in the same organization, you can use a shared subnet.

11. Enter the network name.

12. In the Gateway CIDR field, enter the subnet gateway from the Gateway CIDR column of the selected subnet.

13. Click Add.

14. In the NIC 1 row, in the Network column, select a subnet.

15. In the NIC 1 row, in the IP Mode column, select Static - Manual.

16. In the NIC 1 row, in the IP column, enter an IP address from the subnet other than the gateway address.

17. If you need to protect a virtual machine in a different organization, a cloud server, a cloud database, a dedicated server, colocation equipment, or a Managed Kubernetes cluster, connect them to the firewall via the global router.

2. Check interfaces

UserGate network interfaces are combined into zones for which security policies are configured. By default, the internet port is assigned to the Management zone. It is used for internet access and connections from external networks.

After adding the local network interface, check that the Internet port is in the correct zone and reassign it if necessary.

UGOS 6

1. Open the CLI.

2. Perform a software restart of the server.

3. When the system boots, select Support Menu.

4. Select Refresh NIC names and click OK.

5. Wait for the restart to complete.

6. Authorize using the default data:

   • login — Admin;
   • password — utm.

7. Print the list of interfaces:

   iface list

8. Make sure that for the internet port, the zone line is set to Management.

9. If the value does not match, change the zone for the Internet port:

   iface config -name <eth_name> -zone Management

   Specify <eth_name> — the name of the internet port.

UGOS 7

1. Open the CLI.

2. Select the UGOS NGFW (serial console) mode.

3. Authorize using the default data:

   • login — Admin;
   • password — leave the field empty.

4. Go to configuration mode:

   configure

5. Update the NIC:

   clear network interface-mapping

6. Restart the server:

   reboot

7. Enter your login and password.

8. Go to configuration mode:

   configure

9. Print the list of interfaces:

   show

10. Make sure that for the internet port, the zone line is set to Management.

11. If the value does not match, change the zone for the Internet port:

    set network interface adapter <eth_name> -zone Management

    Specify <eth_name> — the name of the internet port.

UGOS 7.1 and higher

1. Open the CLI.

2. Select the UGOS NGFW (serial console) mode.

3. Authorize using the default data:

   • login — Admin;
   • password — usergate.

4. Go to configuration mode:

   configure

5. Update the NIC:

   clear network interface-mapping

6. Restart the server:

   reboot

7. Enter your login and password.

8. Go to configuration mode:

   configure

9. Print the list of interfaces:

   show

10. Make sure that for the internet port, the zone line is set to Management.

11. If the value does not match, change the zone for the Internet port:

    set network interface adapter <eth_name> -zone Management

    Specify <eth_name> — the name of the internet port.

3. Configure the local interface on the firewall

1. Connect to the firewall.
2. Go to Settings → Network → Interfaces.
3. For the added port port1, click Enable.
4. Click Edit.
5. Open the General tab.
6. In the Zone field, select Trusted.
7. Open the Network tab.
8. In the Mode field, select Static.
9. Click Add.
10. Enter the IP address of the interface.
11. Optional: change the mask.
12. Click Save.

4. Configure the NAT rule

1. Connect to the firewall.
2. Go to Settings → Network policies → NAT and routing.
3. Click Add.
4. Open the General tab.
5. Enter the name of the rule.
6. Optional: enter a description for the rule.
7. Select the type — NAT.
8. In the SNAT IP field, enter the IP address of the firewall's internet port that the source address will be replaced with. If the firewall is deployed on a cloud server with a single public address, specify the address from the private network to which the public address is associated.
9. Open the Source tab.
10. In the Source zone block, select the Trusted checkbox.
11. Optional: add a specific IP address or subnet that can be a traffic source. In the Source address block, click Create and add a new object → Add, enter the addresses, and save the object. If you do not add addresses, the rule will apply to traffic from all private networks behind the firewall.
12. Open the Destination tab.
13. In the Destination zone block, select the Management checkbox.
14. Optional: add a specific IP address or subnet where traffic can be sent. In the Destination address block, click Create and add a new object → Add, enter the addresses, and save the object. If you do not add addresses, traffic can be sent to any external networks.
15. Optional: to restrict the list of ports for outbound traffic, add them on the Service tab.
16. Click Save.

5. Configure filtering rules

1. Connect to the firewall.
2. Go to Settings → Network policies → Firewall.
3. Click Add.
4. Open the General tab.
5. Enter the name of the policy.
6. Optional: enter a description for the policy.
7. Select the action — Allow.
8. Open the Source tab.
9. Select the Trusted checkbox.
10. Optional: add a specific IP address or subnet that can be a traffic source. In the Source address block, click Create and add a new object → Add, enter the addresses, and save the object. If you do not add addresses, the rule will apply to traffic from all private networks behind the firewall.
11. Open the Destination tab.
12. In the Destination zone block, select the Management checkbox.
13. Optional: add a specific IP address or subnet where traffic can be sent. In the Destination address block, click Create and add a new object → Add, enter the addresses, and save the object. If you do not add addresses, traffic can be sent to any external networks.
14. Optional: to restrict the list of ports for outbound traffic, add them on the Service tab.
15. Click Save.