Understanding Firewall Interfaces: Securing Your Network with UniFi Devices

Hi, I’m Juan David, Flytec’s Tech Lead Support and UniFi Certified Trainer. Today we’re diving into one of the most important topics in network security: firewalls and their interfaces. Firewalls are the first line of defense in protecting your network from unauthorized access and potential threats. Whether you’re running a home network or managing a large-scale enterprise, firewalls are essential for maintaining safety and performance.

In this blog, I’ll walk you through what firewalls are, how they work, and how to optimize them using interfaces and VLANs with UniFi devices. Let’s get started!

What is a Firewall?

A firewall is a security system designed to filter, monitor and control incoming and outgoing traffic in a network. Its main purpose is to block unauthorized access while allowing legitimate traffic to flow freely. Think of a firewall as a security guard that ensures only authorized personnel can enter a building.

Firewalls serve as a safety barrier between your private network and the public internet, or even between internal network segments, protecting against malicious actors, hackers, and harmful traffic. They are especially critical in large organizations with many devices, servers, and sensitive data to protect.

Devices like the UniFi Dream Machine Pro (UDM-Pro) and Enterprise Fortress Gateway (EFG) seamlessly integrate firewall capabilities with centralized management, making them ideal for securing both small and enterprise-level networks.

How Firewalls Work

Firewalls operate based on rules, also known as an Access Control List (ACL). These rules dictate what traffic is allowed or denied based on several parameters, including:

• IP Addresses
• Domain Names
• Protocols
• Port Numbers
• Keywords

For example, you can configure a firewall to allow traffic from specific IP addresses while blocking all others. Similarly, you can permit traffic only on specific ports, such as Port 80 for HTTP or Port 443 for HTTPS.

Firewalls come in two main types:

1. Host-Based Firewalls: These are software-based firewalls installed on individual devices to protect them specifically.
2. Network-Based Firewalls: These are hardware or hybrid systems designed to protect entire networks.

For managing larger networks, devices like the UniFi Gateway Pro (UXG-Pro) provide advanced routing and robust firewall features to safeguard internal and external traffic.

Firewall Interfaces: Breaking It Down

To effectively manage traffic, firewalls rely on various interfaces. Each interface plays a distinct role in maintaining security and organizing traffic flow.

1. Inside Interface

• Represents the trusted internal network.
• Handles traffic originating from your LAN (Local Area Network).
• Examples: Internal servers, office computers, or workstations.

2. Outside Interface

• Represents untrusted networks, such as the internet.
• Examines and filters incoming traffic to prevent threats from accessing your internal network.

3. DMZ (Demilitarized Zone) Interface

• Acts as a middle ground between trusted and untrusted networks.
• Hosts publicly accessible resources like web servers while limiting access to your internal network.

4. Management Interface

• Dedicated to managing and configuring the firewall.
• Restricted to internal or authorized users to prevent unauthorized access.

5. VPN Interface

• Facilitates secure remote access to your private network over public internet connections.

6. VLAN Interfaces

• Virtual Local Area Networks (VLANs) enable you to segment network traffic for better security and performance.

Leveraging VLANs for Security and Performance

A VLAN (Virtual Local Area Network) is a virtual network created to isolate traffic within a physical network. VLANs enhance security by ensuring that devices in one VLAN cannot communicate with devices in another without explicit permissions.

Devices like the UniFi Switch Pro 24 (USW-PRO-24) support VLAN tagging and make it easy to isolate and manage network traffic for security and performance optimization

Why VLANs are Important

1. Improved Security: VLANs isolate sensitive data and devices, minimizing risks.
2. Better Performance: They reduce congestion by segmenting traffic.
3. Simplified Management: Devices can be grouped logically, making network monitoring and troubleshooting easier.

Creating a VLAN with UniFi

UniFi devices make setting up VLANs straightforward. Here’s a simplified process:

1. Access the UniFi Network Application and navigate to the Networks section.
2. Create a new network, assigning it a unique VLAN ID.
3. Configure settings such as DHCP to manage IP address allocation.
4. Apply the VLAN to switch ports and wireless networks as needed.

Configuring Firewall Rules with UniFi

While VLANs help isolate traffic, firewall rules ensure unauthorized traffic doesn’t pass between VLANs. Layer 3 UniFi devices like the UniFi Switch Enterprise 48 PoE (USW-Enterprise-48-PoE) can allow communication between VLANs, a concept called Inter-VLAN hopping. To control that traffic and enhance security, you’ll need to create some firewall rules.

How to Configure Firewall Rules:

• Create Firewall Rules:
  • Go to Settings > Security > Traffic & Firewall rules and add a new rule.
  • Specify the source VLAN (e.g., IoT VLAN) and restrict its access to other VLANs.
  • Apply the rule before predefined rules for maximum effectiveness.

Best Practices:

• Block All, Allow Specific: Default to blocking all inter-VLAN traffic, then create rules for necessary communication.
• Order Matters: Firewall rules are processed top-down, so place block rules after specific allow rules.
• Use Profiles: Group commonly used IPs, ports, and rules into profiles for easier management.

Firewall Rules in Action

Let’s say you’ve set up an IoT VLAN for smart devices and want to ensure they can only access the internet but no other internal devices:

1. Create a rule to block traffic from the IoT VLAN to other VLANs.
2. Add exceptions for DNS or necessary services to ensure functionality.
3. Test the configuration by pinging devices within and outside the VLAN to confirm traffic is restricted.

Conclusion

Firewalls and VLANs are the cornerstones of a secure and efficient network. By leveraging interfaces and carefully crafted rules, you can ensure that your network remains safe from threats while optimizing performance.

At Flytec, we’re here to help you configure and manage your UniFi devices for maximum security and functionality. Whether you’re setting up a home network or managing an enterprise environment, we’ve got you covered.

For more tips and support, feel free to contact us. Until next time, stay secure!