Copyright (c) Fire4 Systems Inc, 2019. All rights reserved
13
When the Authonet firewall is installed in a network, all data communications from the Internet
to the network computers (WAN to LAN) and all communications from the network computers to
the Internet (LAN to WAN) is blocked.
It is desirable that communications from WAN to LAN is always blocked to prevent hackers
getting access to the network computers. It is possible to open access (see Port Forwarding in a
later section) however any point of access is a weakness that a hacker can exploit.
Computers in the network will need to access the Internet, however the access provided should
be limited to prevent a hacker communicating with a trojan that has been installed on a network
computer (see Part 1).
Internet access permissions are given to a network computer by first assigning it to a group, then
assigning one or more access rules to the group.
As stated previously, it is far safer to assign domain (website) access only for those websites that
are required to be accessed by the network computer. Allowing access to all Internet websites
will permit a trojan virus to communicate with the hacker if accidentally installed on the network
computer.
When the Authonet firewall is installed it has two default groups, the unknown devices and the
known devices. The devices (computers and peripherals) connected to the network as listed as
unknown devices. Each device can be given a name (e.g. the name of the users) and then it
moves to the known devices group.
Subsequently, new groups can be created, and both unknown and known devices can be moved
to the new group. Groups are usually created to represent the departments of a business (e.g.
management, sales, accounting, etc) as it is usual that all computers within a department will
have identical Internet access rules.
What is a device? it has a MAC address and has requested an IP
address
A device is a computer or peripheral (e.g. printer) that has a MAC address. A computer device
will represent one or more network users. Devices will usually request an IP address from the
Authonet firewall. Some devices may require a static IP address and this should be allocated
within the LAN subnet range, but outside the LAN DHCP range (e.g. 172.16.0.2 to 172.16.0.254).
When the device is first connected to the network it is listed as an unknown device. The device
should be given a name, preferably the name of the user, so that it can be recognized when
looking at log information on the Authonet admin pages. When the device has been given a
name it is moved to the known devices group.
Internet
Internet
Device
LAN
Internet
WAN
LAN > WAN access for a device is
determined by the firewall rules that are
assigned to the group to which the device
belongs
Device Group 1
Device B
Device A
Access
rules
Device Group 1
Device B
Device A
Access
rules
Device Group 1
Device B
Device A
Access
rules
