Kaspersky Embedded Systems Security for Linux
3.4.0
English

Contents

Firewall Management in the Administration Console

In the Administration Console, you can configure Firewall Management settings in the policy properties (Application settings → Essential Threat Protection → Firewall Management).

Firewall Management settings

Setting

Description

Enable Firewall Management

This check box enables or disables Firewall Management.

This check box is cleared by default.

Network packet rules

This group of settings contains the Configure button. Clicking this button opens the Network packet rules window. In this window, you can configure network packet rules that are applied by the Firewall Management component when it detects the network connection attempt.

Available networks

This group of settings contains the Configure button. Clicking this button opens the Available networks window. In this window, you can configure the list of networks that the Firewall Management component will monitor.

Incoming connections

In this drop-down list, you can select the action to be performed for incoming network connections:

  • Allow network connections (default value).
  • Block network connections.

Incoming packets

In this drop-down list you can select the action to be performed for incoming packets:

  • Allow incoming packets (default value).
  • Block incoming packets.

Always add allowing rules for Network Agent ports

This check box enables or disables automatic adding allowing rules for Network Agent ports.

The check box is selected by default.

Page top

[Topic 197314]

Network packet rules window

The Network packet rules table contains network packet rules that the Firewall Management component uses for network activity monitoring. You can configure the settings described in the table below for network packet rules.

Network packet rules settings

Setting

Description

Name

Network packet rule name.

Action

Action to be performed by Firewall Management when it detects the network activity.

Local address

Network addresses of devices that have Kaspersky Embedded Systems Security installed and can send and/or receive network packets.

Remote address

Network addresses of remote devices that can send and/or receive network packets.

Logging

This column shows if the application logs actions of the network packet rule.

If the value is Yes, the application logs the actions of the network packet rule.

If the value is No, the application does not log the actions of the network packet rule.

By default, the table of network packet rules is empty.

You can add, edit, delete, move up, and move down network packet rules in the table.

Clicking the Move down button moves the selected item down in the table.

This button is available if only one item is selected in the table.

Clicking the Move up button moves the selected item up in the table.

This button is available if only one item is selected in the table.

Clicking the Delete button removes the selected item from the table.

This button is available if at least one item is selected in the table.

The selected element's settings are changed in a separate window.

Clicking the Add button opens a window where you can specify the new item settings.

Page top
[Topic 202312]

Added network packet rule window

In this window, you can configure the added network packet rule settings.

Network packet rule settings

Setting

Description

Protocol

You can select the type of data transfer protocol for which you want to monitor network activity:

  • Any (default value)
  • GRE
  • ICMP
  • ICMPv6
  • IGMP
  • TCP
  • UDP

Direction

You can specify the direction of network activity being monitored:

  • Incoming packets. If this option is selected, the Firewall Management component monitors incoming packets.
  • Incoming. If this option is selected, the Firewall Management component monitors incoming network activity.
  • Incoming/Outgoing. If this option is selected, the Firewall Management component monitors both incoming and outgoing network activity.
  • Incoming/Outgoing packets. If this option is selected, the Firewall Management component monitors both incoming and outgoing packets.
  • Outgoing packets. If this option is selected, the Firewall Management component monitors outgoing packets.
  • Outgoing. If this option is selected, the Firewall Management component monitors outgoing network activity.

ICMP type

You can specify the ICMP type. The Firewall Management component monitors messages of the specified type sent by the host or gateway.

If the Specified option is selected, the field for entering the ICMP type will be displayed.

This window is displayed if the ICMP or ICMPv6 data transfer protocol is selected in the Protocol drop-down list.

ICMP code

You can specify the ICMP code. The Firewall Management component monitors messages of the type specified in the ICMP type field, with the code specified in the ICMP code field, and sent by the host or gateway.

If the Specified option is selected, the field for entering the ICMP code will be displayed.

This window is displayed if the ICMP or ICMPv6 data transfer protocol is selected in the Protocol drop-down list.

Remote ports

You can specify the port numbers of the remote devices between which the connection is to be monitored.

If the Specified option is selected, the field for entering the port numbers will be displayed.

This window is displayed only if TCP or UDP data transfer protocol is selected in the Protocol drop-down list.

Local ports

You can specify the port numbers of the local devices between which the connection is to be monitored.

If the Specified option is selected, the field for entering the port numbers will be displayed.

This window is displayed only if TCP or UDP data transfer protocol is selected in the Protocol drop-down list.

Remote addresses

You can specify the network addresses of the remote devices that can send and receive network packets:

  • Any address (default value). If this item is selected, the network rule controls network packets sent and/or received by remote devices with any IP address.
  • Specified address or address range. If this option is selected, the network rule controls the sending and receiving of network packets by remote devices with the IP addresses that are specified in the table below. Clicking the Add button above the table opens the Add IP addresses window, in which you can specify an IP address of the device, a network address, or a range of IP addresses.
  • By network type. If this item is selected, the network rule controls network packets sent and received by remote devices with the IP addresses associated with the selected network type: Public networks, Local networks, or Trusted networks.

Local addresses

You can specify the network addresses of the devices with Kaspersky Embedded Systems Security installed that can send and receive network packets:

  • Any address (default value). If this option is selected, the network rule controls network packets sent and/or received by the devices with Kaspersky Embedded Systems Security installed regardless of their IP address.
  • Specified address or address range. If this option is selected, the network rule controls the network addresses of devices with Kaspersky Embedded Systems Security installed that can send and receive network packets. These network addresses are specified in the table below. Clicking the Add button above the table opens the Add IP addresses window, in which you can specify an IP address of the device, a network address, or a range of IP addresses.

Action

You can select an action to be performed by the Firewall Management component when it detects network activity:

  • Block network activity.
  • Allow network activity (default value).

Logging

You can specify whether the actions of the network rule will be logged in the report.

Rule name

The field for entering the name of the network packet rule.

Page top

[Topic 210510]

Add IP addresses window

In this window, you can specify the IP address of the device, network address or range of IP addresses.

You can specify multiple addresses; enter each address on a new line for convenience of copying them.

Page top
[Topic 291951]

Available networks window

The Available networks table contains the networks controlled by the Firewall Management component. The table of available networks is empty by default.

Available networks settings

Setting

Description

IP address

Network IP address.

Network type

Network type (Public network, Local network, or Trusted network).

You can add, edit, and delete available networks.

Clicking the Delete button removes the selected item from the table.

This button is available if at least one item is selected in the table.

The selected element's settings are changed in a separate window.

Clicking the Add button opens a window where you can specify the new item settings.

Page top

[Topic 276434]

Network connection window

In this window, you can configure the network connection that the Firewall Management component will monitor.

Network connection

Setting

Description

IP address

The field for entering IP address of the network.

Network type

You can select the type of the network:

  • Public
  • Local
  • Trusted

     
Page top
[Topic 276435]