Forum Discussion

aj11's avatar
aj11
Icon for Nimbostratus rankNimbostratus
Aug 03, 2017

How do I block (packet filtering?) all external IPs?

We have a BIG-IP (F5) unit set up at a backup site. We want to lock this unit down so that no public access is allowed while not in use, and any external scans won't even know there is anything there until it is opened. So far, all the Virtual IPs get disabled, but we want to prevent anything from getting even that far. I suppose high-level packet filtering is what I want, blocking everything but management and internal IPs for the developers to work on the internal systems and within BIG-IP, and allowing access to reopen everything once this backup site becomes active. What is the simplest/best approach to accomplish this?

 

BIG-IP
LTM
security

8 Replies

Sort By
  • Jeff_Maddox_394's avatar
    Jeff_Maddox_394
    Historic F5 Account
    Aug 03, 2017

    The default behavior for disabled virtual servers is to send a RST to a SYN. If you are looking for a passive drop behavior, then a packet filter rule with the action set to "discard" would do the trick.

     

    • aj11's avatar
      aj11
      Icon for Nimbostratus rankNimbostratus
      Aug 03, 2017

      Thanks. I created a Packet Filter rule to allow an internal subnet (First) and tried to create another rule (Last) to drop (Action: "discard") everything else where the instructions in the doc linked below say to "Enter Expression Text" with nothing in the text field, which apparently means everything (?), and I got the following error:

       

      01070087:3: Packet filter rule '/Common/TestRule1': rule matches all traffic and action is not "continue"

       

      https://support.f5.com/content/kb/en-us/products/big-ip_ltm/manuals/product/bigip-datacenter-firewall-config-11-1-0/_jcr_content/pdfAttach/download/file.res/BIG-IP%C2%AE_Data_Center_Firewall_Configuration_Guide.pdf

       

      Why should the rule be set to "continue" rather than "discard"?

       

    • aj11's avatar
      aj11
      Icon for Nimbostratus rankNimbostratus
      Aug 04, 2017

      So I got it to accept 2 rules I put in where I had to add an actual expression to "Enter Expression Text" field, but I have not yet enabled packet filtering. The instructions on that page I linked basically just says to select that checkbox and that's it.

       

      What I have so far, Jeff, and please correct me if this is wrong, but I have the following: Rule 1 (First): Allow ("Accept")the management networks (ie: ( src net 192.168.1.0/24 ) and ( dst net 0.0.0.0/0 )) on all vlans. Rule 2 (Last): Deny ("Discard") everything else (ie: ( src net 0.0.0.0/0) and ( dst net 0.0.0.0/0 )) on all vlans.

       

      Will this accomplish what I'm looking for?

       

    • Jeff_Maddox_394's avatar
      Jeff_Maddox_394
      Historic F5 Account
      Aug 04, 2017

      Anything that does not match the first rule should hit the second rule, which is basically the same as unhandled traffic. You can verify in the var/log/pktfilter file. Make sure you have console access when you test. There maybe variables that I am not aware of in your set up.