TerraMaster Forum

- TOS 4.2.15 on F2-221 (x86)
- STeps to reproduce:

1. Go to Control Panel > General Settings section > Security > Firewall
2. Add new rule by selecting create
3. Type in a name such as "fwtest1"
4. Select "Enable" as Operation and leave other options as is (enable unchecked), TCP and UDP as protocols checked
5. Click next
4. Select single IP Address and type "1.1.1.1" for example
5. Click next
6. Page displays only "All" as choice under Ports. >> BUG 1 <<
7. Click confirm
8. Config failed is displayed >> BUG 2 <<

Hi,
Our permission rules are for the type of access protocol. Do you want to allow only certain ports of TCP or UDP for a certain IP?

I just made a test, but unfortunately, I didn't find such an issue as you described. would you provide more specific how-to reproduce such an issue?

I've tested with Firefox latest and Brave latest to get 2 different HTML rendering engines
The issue seems that the fields are here but set with the display none attribute (see latest screenshot)

I'm not sure which logs could help you troubleshoot this. Do you want the network trace of files being loaded by the browser?

Hi！When setting firewall rules and checking the “Accept” operation, the IP of the computer you are using should be included, otherwise the setting will fail.

That doesn't solve the issue :

Hi. This is normal firewall logic.
Generally speaking, if you do not set up a firewall, all IPs and ports are allowed, so setting "allow" means to disable other ips except the allowed ips. If other keys such as the ip of the network card are not listed in the allowed ip, they cannot be set. (Otherwise it will never be accessible)

That some rules must be enforced to avoid to saw off the branch you're sitting on is of course a valid point, but that's not the scenario here

There is an inconsistency in the behavior you describe and the UI interface.

E.g.
You may well have the "Allow TELNET/SSH only from local network" enabled in the SSHD/Telnet part of the UI for example.

In that case, everything which is not from a private IP is denied access to ports 9222/23.
You are then unable to add an external IP to the list of allowed machines for SSHD without adding a "accept" rule.
How then would you do that?
Do not tell me to "Reject all" for that port, because in that case you're sawing off the branch on which you're sitting since you are not able to enter the "accept" rules for the external IP and the local private IP first....

In the same way, how would you some other services other than ssh/telnet to be allowed only from the local network (10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16)?

In addition, as far as TOS 4.2.15 is concerned, even if there is no rule defined in the firewall UI, there are still rules defined in the iptables chain so you cannot say "firewall not set" since there are always some rules enforced. (I'm not mentioning here the fact that the interface doesn't give you a general enable/disable flag at the UI level or that the DOCKER application creates its own chain)

Hi!
Currently, you cannot customize the port when creating a firewall accept operation rule, but you can customize the port for a reject operation rule.
Enabling "Allow TELNET/SSH access only within the local network" only prohibits other network segments from accessing the NAS terminal, and you can still access the NAS in the browser.