This article applies to:

• WF, WFR, R3000

Question:

How to install the Web Filter in Firewall Mode

Reply

How to install the Web Filter in Firewall Mode

The firewall mode is a modification of the router mode. With the filter set up in this mode, the unit will filter all requests.  If the request is appropriate, the original packet will pass unchanged. If the request is inappropriate, the original packet will be blocked from being routed through.

Using the firewall mode, while the outgoing request is delayed slightly—to allow filtering to take place before the
packet leaves the gateway router of the network—return traffic remains unaffected.

The firewall mode cannot be used with any other mode (invisible or router).

NOTE:  Running the filter in pass-thru INVISIBLE MODE is generally more efficient, and least likely to slow down your network, than Router or Firewall modes.

If you wish to configure the filter in Firewall  Mode, do the following:

Go to System -> Network -> LAN Settings:

1) Both interfaces need to be be on separate segments in the network (i.e. in different subnets).

2) The default gateway will be on the same subnet as LAN2.

Go to System -> Mode -> Operation Mode
 
3) The Listening Device will be LAN1.

4) The Block Page Device will be LAN1

5) Specify Firewall Mode.

6) Once you have complete the steps, REBOOT the filter. Then verify that you can ping both interfaces from their respective segments.

7) Connect the R3000 into the switch (possible multiple vlan configuration)
 
8) Confirm that you can ping/reach LAN1 from your LAN Router.
 
9) Configure your LAN router to route traffic to LAN1. It is recommended that you use policy routing to only route traffic through web filter that needs to be filtered. Why is this?  For example, if you send your email traffic (port 25) through the R3000, you will not be able to send outgoing email if the filter goes down or quits filtering.  If the filtering stops working for whatever reason, traffic stops flowing through the web filter.

10) Configure a static or an asymmetric route in your upstream router for *all* incoming traffic to go directly to the LAN. In other words, don't route incoming traffic to the web filter.

This article was previously published as:

8e6 KB 301520