FireBrick 105 User manual

FireBrick 105
Manuals
Home
Introduction
The FireBrick 105 is a sophisticated router/firewall product that is designed to be the key device between the
internet and your network. It provides state tracking firewalling and routing as well as useful features such as
network address translation and automatic IP address allocation. The FireBrick has a number of optional
extras making it invaluable at home or in an office. Whilst it is only a small box, it has the power to handle the
fastest 8Mb/s ADSL internet links running flat out and handle hundreds of computers in a large office network.
Using this manual
This manual covers the basic operations clearly and simply, and acts as a reference. There are sections for
each of the FireBrick configuration icons, and sections describing the underlying functionality of the FireBrick.
Each section has at the end a Technical Reference which goes in to much more detail about that section with
a number of key technical points and notes listed. There is also a section describing each of the optional extra
features that are available. Generally, the manual will describe the operation with most features installed, and
so your FireBrick may be missing some of the options listed if you do not have all features.
Basic terms
There are some key terms used throughout the manual which it is useful to understand. Please read these
first.
LAN Local Area Network. This is a group of devices connected together, normally using ethernet, which can communicate directly with each other. It can include cables, hubs, switches, and even wireless
access points.
LAN,
WAN,
DMZ
LAN, WAN (Wide Area Network) and DMZ (DeMiliterized Zone) are used to describe the sides of a
firewall. They are all LANs but the WAN is used to describe the outside (connected to the rest of the
world), The LAN is the inside connected to your network, and any DMZs are used for servers which
are typically protected from the WAN but from which your LAN is protected in case such machines
are compromised. Normally the single port on the left is the WAN and the 4 ports on the right are the
LAN.
IP Internet Protocol. An IP address is four parts with dots, e.g. 192.168.0.1. The FireBrick supports only
conventional IP (version 4).
Mask (Netmask, Subnet mask) is used to define the size of a local area network. Usually shown in the same format as an IP address, e.g. 255.255.255.192, but also shown as a bit count on the end of an
IP address, e.g. 192.168.0.1/24. See Networks for more details.
Port End point identity used by TCP and UDP protocols, a number 1 to 65535
TCP Transport Control Protocol − used for most session based communications such as web pages,
email, etc.
UDP User Datagram Protocol − used for realtime and transaction based communications such as DNS
and voice over IP.
DNS Domain Name Service − the way in which machine names are converted to IP addresses, and
various related functions.
Getting started
A quick start guide is included with your FireBrick (PDF).
It is very simple to connect your FireBrick to an existing network and make use of it's facilities with no
additional configuration. Once connected, it is simple to access the configuration pages and make any
FireBrick 105 Manuals
Introduction 1

changes you wish.
There are 5 ethernet ports on the front of the FireBrick. The one of the left is normally the WAN side, and the
4 on the right are normally a high speed network switch connected to the LAN side. All ports support
10base−T and 100base−T as well as Full and half Duplex automatically and also have auto crossover to
avoid any confusion with straight or crossover cables. The power connector is at the rear and should be used
with the supplied power supply or equivalent.
Connecting a FireBrick in to an existing network
Check you have internet access from your computers.1. Locate the router which connects your network to the internet. If you have ADSL, then this will
probably also connect to a telephone socket. It should have a cable which connects from it to your
network. It may have more (perhaps up to 4). If you find something with more cables, e.g. 8 or more,
that is probably a switch or hub and not the router.
2.
Place the FireBrick near this router and connect the power. The lights will cycle on the front.3. Remove the cable(s) from the router which connect the router to your network, and plug them in to the
right hand side of the FireBrick. It does not matter which of the 4 ports they connect to. As you
connect each cable, the green light above the cable should light after a second or two.
4.
Connect a cable (one is supplied) from the single left hand port on the FireBrick to the socket on the
router from where the previous cables were removed. If there is more than one socket, any will do.
When you do this the light above the port on the FireBrick should light up after a second or two.
5.
Check you still have internet access from your computers.6. Use one of the computers with web browser to access http://my.FireBrick.co.uk/ where you should
see a configuration screen.
7.
Connecting a FireBrick to a PC for stand alone configuration
Connect the power. The lights will cycle on the front.1. Connect a cable from one of the 4 ports on the right to your PC. The light over the port on the
FireBrick should come on after a second or two.
2.
Configure your PC to have IP address 217.169.0.2 with netmask 255.255.255.2523. Use a web browser on your PC to access http://217.169.0.1/ where you should see a configuration
screen.
4.
Factory reset
It is quite possible with any firewall product to mis−configure the unit so that you are unable to access it or
make further configuration changes. Whilst this is unlikely, if this happens then the only option is a factory
reset. As a security product, there are no back doors to help you if you forget the passwords you have set.
To factory reset:−
Disconnect the power and all network leads1. Connect a network lead from the Left hand single port to the right hand port of the four ports on the
right.
2.
Connect the power and wait 2 seconds3. The green POWER light should be blinking4. Disconnect the network lead5. The FireBrick will factory reset immediately6.
There are alternative factory resets which can be used depending on which of the 4 ports on the right are
connected to the single port on the left. If the left hand port is used then the factory reset will include DHCP
client on the WAN and DHCP server+client on the LAN. If the middle ports are used then they have the same
effect as their adjacent end port but the WAN and LAN become reversed such that the single port is the LAN
and the four port switch is the WAN.
FireBrick 105 Manuals
Introduction 2

Basic configuration
Accessing the FireBrick web pages there are a number of basic configurations steps which are
recommended. You will find that the web pages have prompts to take you through these steps as follows:−
Setting an admin password. The FireBrick has a username/password security system, and you can
define a number of users with different levels of access. Initially it is sensible to set a password on the
admin user.
1.
Logging in as Administrator. Having set a password you should log in using that password. This
allows you access to all of the FireBrick features, and you will see many more icons on the
administration pages once logged in.
2.
Removing default view/edit rights from the nobody user. Without a password you still had some
access to the FireBrick and it is sensible to now remove that access so that anyone accessing the
FireBrick web configuration pages must login before they can do anything.
3.
Once an IP address is set up you may find you have to log in again − this is because the FireBrick will
have just set its clock from the internet.
4.
The features menu under the Setup icon allows you to check you have all features installed. If you
purchased any extra features with your FireBrick then they will be installed at this point.
5.
Registration − by registering your FireBrick you can receive any notices by email advising of new
software, features, or security alerts. Registration may also provide additional extended warranty.
6.
Tips
Moving entries
Many of the configurations entries have a small green dot next to each entry − clicking on this dot allows the
entry to be picked up and moved. Once picked up simply select one of the green arrows next to an entry to
move it there. You can change to other pages of the same list first if necessary.
Entering IP ranges
When entering IP ranges you can enter :−
Blank for any range1. A single IP in thje left hand box for a single IP match2. The lowest IP in the left box and the highest in the right box as a range of IPs3. Any IP in the left box and a subnet mask in the right box for a range specified using a subnet mask4. Any IP in the left box and a subnet bit count in the right box for a range specified using a subnet
bitcount
5.
In the last two cases the range is filled in when saved.
FireBrick Plus and FireBrick SoHo
If you have used a FireBrick Plus or SoHo model in the past, the FireBrick 105 has a number of new features.
See the list of differences.
You can load a FireBrick SoHo or FireBrick Plus configuration in to the FireBrick 105 if you wish.
FireBrick 105 Manuals
Introduction 3

FireBrick 105
Manuals
Home
Setup
The setup function consists of a number of general setup facilities that can be selected from a sub menu.
Save config
This allows the current configuration of the FireBrick to be saved on your local PC. Selecting save config will
normally cause your browser to pop up with a save box allowing you selected where to save the config. The
default filename is the serial number of your FireBrick, allowing you to save many configs in one directory
without risk of overwritting a different one. Once saved, the config can be reloaded in to the same or a
different FireBrick. It is recommended that after any major changes you save your config
Clear Alert
If an alert is set (using Flash in any filters) then this stays set and the ALERT light continues to flash until you
clear it using this link. The date/time is shown as when the alert was first set (if the clock is set).
Upload/Restore
This allows one of three types of files to be uploaded. Simply select the required file using the Browse button
and click Send.
FA flash file can be obtained from the FireBrick software web site. Uploading this will reprogram your FireBrick with a new version of software and usually then require the loading of a W file. The FireBrick
will stop operating for up to a minute while flashing new softwate.
W
A web file contains all of the user interface (web pages) allowing you to manage your FireBrick.
Without this you will see a User Interface Required page where you can load any of these 3 file types.
Normally, for English web pages the file ends in WEN. You must load the version expected, or load a
new flash file or config.
Config A saved configuration file can also be loaded. This will completely replace the previous configuration
with the new configuration.
LEDs
The LEDs (lights) over each port can be controlled in a number of different ways depending on your
preference. There are 6 pre−defined combinations, a cycling lights option and the option to choose the yellow
and greed LED functions directly. When cycling lights are selected the 4 ports on the right cycle the LEDs
left/right/left all the time.
Ports
The Ports menu allows settings for all 5 ports to be controlled. With the 5PORT option the port configuration
can be selected. Without the 5 port option, the WAN/LAN reverse can be selected. For normal use the
settings should all be left on Auto.
FireBrick 105 Manuals
Setup 4

Name Interfaces are normally called WAN or LAN, but you can set the name yourself.
Crossover Normally the FireBrick can be connected using a straight or crossover lead to a hub/switch or a computer directly. This allows specific select of the crossover mode (MDIX is a normal switch/hub
connection and MDI is a normal PC connection).
Speed Normally the FireBrick detects 10base−T or 100base−T automatically, but the port can be fixed to
only one speed.
Duplex Normally the FireBrick detects Full or Half duplex mode, but the port can be fixed to only one
mode.
Disable Causes the port to be disabled, allowing no traffic in or out.
Throttle Causes the speed of traffic in and out to be cut to 128Kb/s. This is not traffic shaping but a crude
packet limit which can be useful for network debugging.
B/Limit Causes the speed of any broadcast traffic (or mulicast or flooded unicast) traffic to be limited to 128Kb/s. This can help track down and limit broadcast storms or loops and is mainly useful for
network debugging.
Long Ethernet cables are meant to only run 100m max. This option allows 10base−T sensitivity to be
increased to allow use over longer cables (at your own risk).
Test This causes a line test of the port (see below)
Reverse This allows the WAN and LAN side to be reveresed. The change takes affect when you reset the
FireBrick
Line test
The line test will take the port out of action for a few seconds and perform a time domain reflectometry
measurement on the cable. The results are indicated on the right of the table when the tests are complete and
remain visible until next reset/power cycle. This type of test can be effective on cables over 3m in length but
the results should always be considered only an approximate indication.
If a cable is connected to a correct hub or switch or computer at the far end then the test simply indicates
connected. If the cable is broken or shorted then this is indicated along with the distance.
Name/etc
This allows the identity of the FireBrick to be set.
Name This names the FireBrick. Use a short name, usually related to the site name. To avoid problems with email, etc, use domain valid characters (a−z, A−Z, 0−9, and
hyphen).
Domain This provides a domain name. Again, use domain valid syntax. This is used for
DHCP and with the name for emailed messages. Put your valid internet domain.
Administrator Put the name of the administrator. This is for your own reference, but also reported if
SNMP is enabled.
Location Put the location. This is for your own reference, but also reported if SNMP is enabled.
SNMP Community If this is not blank, then SNMP is enabled. Put the community name required, usually just public. Remember that you can use filters to restrict access to SNMP or any
services on the FireBrick if required.
SNMP options The ifDesc option causes the SNMP ifDesc to be a simple unique number (the SNMP interface index in the OID) rather than a description. This is because some tools
expect it to be unique (e.g. cfgmaker for mrtg)
Gateway
This defines the general gateway IP address and interface. It is used if there are no matching routes or
subnets.
The recommendation is to make this a subnet and not set a gateway address as such − the subnet can then
have the gateway defined, which could be by DHCP.
FireBrick 105 Manuals
Setup 5

Bonding
For full details see the bonding section. This allows up to two pseudo gateways to be specified, and up to four
real gateways to be used in their place on a cyclic basis.
Stealth
This is not how you give the FireBrick and IP address. You can speficy the LAN stealth address on which the
FireBrick will answer even for traffic passing through it. The FireBrick effectively hijacks traffic to this address.
You can also set an address for the FireBrick to borrow on the WAN when setting it's clock, etc. This is
normally the adderss of a machine on the LAN, and the FireBrick hijacks the replies to it's requests which
would otherwise go back to that machine.
Disable ARP Stops ARPs being sent automatically from one interface to another − this stops most
stealth operations being possible in normal operation
Disable subnet
broadcasts Stops subnet broadcasts (i.e. last address in subnet) being treated as stealth
Disable local
broadcasts Stops local broadcasts (i.e. 255.255.255.255) being treated as stealth
Disable all stealth Disables all stealth operation
Time
The FireBrick sets and maintains its clock from the internet. To set the time the FireBrick will need a gateway
and IP (or stealth WAN IP) so as to be able to send time requests to the internet. The default settings are
correct for UK and UK summer time.
Server Specify the IP of the time server to try, normally 217.169.0.1
Backup Specify a second time server to use if the first does not respond, normally 217.169.0.2
Time offset Select the base time zone, e.g. for UK it is UTC+0
Summer time Select if it is summer time, although this is normally set automatically.
Start summer time Select the date and month, the Sunday on or after which the clocks go forward one hour. You can select manual to stop summer time being adjusted automatically. The time
changes at 1am winter time.
End summer time Select the date and month, the Sunday on or after which the clocks go backwards one
hour.
Profile
The time is set every hour normally, although exactly when in the hour moves about
deliberately. This profile allows this to be restricted to set the clock less often. On power
up / restart, the clock is not set and so it continually tries until the clock is set, ignoring
the profile selected.
Syslog
The FireBrick has an internal log, and can also log to a syslog server. This allows the IP and syslog type to be
set.
Server IP Specify the IP of the syslog server
Port Specify the syslog port (normally 514)
Type Select the syslog type, local0 to local7
Optional Interface Specify the interface or interface and subnet on which the syslog is to be sent,
otherwise normal routing rules apply
Optional Source IP
FireBrick 105 Manuals
Setup 6

Specify the IP from which syslogs are sent − can be any IP as there is no reply to a
syslog. Normally set automatically. Using a subnet for the interface sets the IP of that
subnet
Optional Gateway IP Specify the gateway IP to use. Normally set automatically. Setting a subnet for the
interface sets the IP using the DHCP defined gateway for that subnet.
DNS
The FireBrick acts as a DNS relay, and uses DNS itself. This address defines the DNS server it uses.
Log/Filter Options
This allows defaults and options to be defined relating to logging and filtering. See filters for a description of
Blink, Flash, Log, Syslog, and Email.
Default
filter This defines the default filter action if no other filters are matched.
Event Certain events in the FirebBrick are logged as an "Event". This controls if/how such things are
logged. Generally an event is something that happens that is non critical.
Alert Alerts are normally more important events that are critical.
Debug Debug messages are general additional detailed information.
Stats Stats are generated automatically every 5 minutes showing usage of each filter and speed lane
and interface.
Login OK If a user login is successful it is logged using these options
Login Bad If a user login fails, it is logged using these options
DHCP OK If a DHCP address is allocated (rather than renewed, which is a debug message), then these
options are used.
DHCP Bad If a DHCP operation fails (e.g. no addresses left) then it is logged using these options.
Ping scan If a ping based profile goes on or off line it is logged using these options.
Tunnel
state Log of tunnel state change (up/down), but does not exclude state changes for tunnels in "Timeout keep alive" mode as they would happen all the time.
Large
sessions Sessions where more than a specified amount of data is transferred are logged at the end of the session using these options.
Email
server This defines the IP of the email server to use to send emailed log entries
Test server This sends a test email
From
address This defines the address from which the email is sent.
To address This defines the address to which the email is sent.
Holdoff
Emails are not sent on the first emailable log event happening, there is an initial holdoff (in
seconds) so that related events will appear in the same email. Once sent, there is then an
additional holdoff which is mainly to limit the number of emails that can be sent when there is a
recurring emaillable event.
Profile Emails are only sent during a selected profile.
QOS TOS
value
This allows the specific TOS (type of service) value that is considered to be priority traffic in
bonded tunnels and speed lanes. This defaults to 160 which is typical for SIP phones. If using
VoIP (Voice over IP) then ensure that you set all phones and links to use the same TOS and set
the appropriate value here.
FireBrick 105 Manuals
Setup 7

UI Options
Some general UI options can be set which affect the overall operation of the UI.
IP
display/range Various options allowing you to change the way IP addresses and in particular ranges of addresses are displayed.
Number
grouping This allows numbers to be shown with no grouping,or commas/dots or spaces every three digits from the right.
Decimal point This allows numbers with a decimal point to use a dot or a comma
Speed Select if you prefer to see speeds as KBytes/s (one decimal place) or Kbits/s
Date format The date format can be an ISO format (YYYY−MM−DD), UK (DD−MM−YYYY), US
(MM−DD−YYYY) or full, e.g. nth Month YYYY
Protocol input The protocol selection in various places is normally TCP, UDP or ICMP only. This allows a
full selection of all 254 protocols, or an input box to enter a protocol number.
Warning music There is normally a tune played on a suitably configured PC which is trying to login to a
FireBrick without the correct username or password. This can be disabled.
Security
See security for a more detailed description of the security model. This allows the general security settings for
control of all of the main icons to be specified.
Features
See features for a more detailed description. This allows the current and availabel features to be listed, and
the FireBrick to be updated with new features.
On a new FireBrick you should configure internet access and DNS and time setting, and then select Install
Assigned Features to ensure you have the full set of features provided with yoru FireBrick installed.
Technical Reference
The name and domain are used in the HELO of outgoing emails, and so should be set using domain
valaid characters to avoid problems with some mail servers. Similarly the from and to email addresses
need to be entered carefully.
•
Emailed logs include the first message logged on the end of the subject line. This can be useful if
emailing an SMS gateway.
•
When cycling LEDs mode is used, the extra dot links control the phase of the lights. FireBricks
connected using the WAN port and all set in the mode will synchronise themselves to product a
dramatic effect.
•
When cycling LEDs mode is used, the left hand port used LED mode 5.• As soon as internet access from the FireBrick is possible (i.e. IP, gateway, etc) the clock may set and
this will usually cause the logged on user to be logged off as the time jumps forward.
•
If a port is set all manually (no auto) then auto negotiaton is disabled. This allows operation with some
types of router which do not understand auto negotiation or have it disabled. You should ensure any
manual settings agree with the settings at the other end to avoid problems.
•
LED modes for SPEED and DUPLEX are lit for 100Mb/s and Full duplex.•
FireBrick 105 Manuals
Setup 8

FireBrick 105
Manuals
Home
Users
The FireBrick uses a username/password system to manage security. There can be a number of different
users of the system, and each can have their own access permissions. One user is special, the nobody user,
which defines the permissions before you are actually logged in as anyone else.
Login
If you are not logged in as a specific user, you can select Login on the top left of the screen, and enter a user
name and password. If you are logged in then you have a link to Logout instead. To change to another user,
log out and then log in again.
User settings
Name Allows you to give the user a full name for your reference
Security Sets the security level of this user and so defines who can view or edit the users details
Profile Defines the profile when the user can log in or use the FireBrick.
Login The login name, i.e. what is typed in to the login box
Allow
from You can select one or more interfaces from which this user is allowed to log in.
Page
colour
You can select the background colour for the FireBrick configuration pages when that user is
logged in. This can be useful if you manage several different FireBricks as you can give each a
different colour.
Timeout This defines the timeout, in minutes, after which the user is automatically logged out if they have
no accessed a page for that long.
Lines This defines how many lines are shown on each page of entries in the administration pages.
View
rights
There are 8 security levels, 1 to 8, and the check boxes define which security levels this user can
view. This allows the user to see all details of any items at any level that is ticked, but not
necessarily make changes.
Edit
rights This defines which security levels the user has permission to change. Any items with a level that is ticked can be changed by the this user.
Technical Reference
It is important to also ensure that the nobody user also has permisions from at least the same
interfaces as any specific user otherwise that user could not get to the login screen in order to login
(as they are the nobody user until they have actually logged in). E.g. to allow WAN address to a user,
also allow WAN access for the nobody user.
•
It is not sensible to tick an edit right without a corresponding view right.•
FireBrick 105 Manuals
Users 9

FireBrick 105
Manuals
Home
Status/information
The FireBrick contains a number of useful information and diagnostic tools as follows:−
Status
WAN/LAN This shows the state of the port, green if it is connected, and the speed and duplex
mode
Serial Number This is also shown on the top left.
Base MAC This is the base MAC address used by the FireBrick. The FireBrick uses different MACs
depending on the subnet.
Time now The current time, if set. Note that the setup/UI options allow the format of the time to be
changed
Clock last set The time when the clock was last set. The clock is normally set every hour.
Running since The time when the FireBrick was last reset. Shown if the clock is now set.
DHCP
This lists all of the DHCP addresses the FireBrick has allocated, the time they are due for renewal (2 hours
after they were issued), the MAC address and the machine name. Where there was no machine name you
can set one manually by entering a name in the input box and pressing return.
The FireBrick tries to keep the same address for each device, and will only re−use an address if it is available
and is the oldest (i.e. not used for the longest). You can manually clear an allocation by clicking on the
interface.
ARP
This lists the FireBrick current ARP table, listing the interface, IP address and MAC address of any currently
active IPs communicating with the FireBrick. If the MAC is all 0's then the device is not (or has not yet)
responding and may be turned off or disconnected.
MAC
The MAC report shows the MAC addresses seen currently on each interface. Against the MAC the interface
name is listed. This allows teh specific prot to be identified. The MAC list includes addresses sent by the
FireBrick as well, and these are marked with the FireBrick's name and not a port name,
Sessions
The session list shows all currently active protocols, and also links for ALl, 1MB, and 10MB. The All link shows
all current sessions, whilst 1MB and 10MB show sessions that have currently transferred more than 1MB or
10MB respectively. Selecting a protocol shows all sessions using that protocol.
The session table starts with an S for Stealth and R for Routed and then the protocol name. Clicking on the
FireBrick 105 Manuals
Status/information 10