You can restrict access to PortaSwitch servers so that only connections from trusted IP addresses are allowed, while all other connections can be blocked. Using the Configuration server web interface, you can centrally configure “allow” and “block” rules that apply to specific servers, subnets, and services (such as SSH or web access). This eliminates the need to manually configure firewall rules on each server via the command-line interface, making it easier to protect critical services and ensuring the rules are preserved after the system update.
Each “allow” or “block” rule defines a source (where the connection originates) and a destination (what is being accessed). For both the source and destination, you can specify an individual IP address (e.g., 198.51.100.5), a subnet – a range of IP addresses (e.g., 203.0.113.0/24), or a wildcard (0.0.0.0/0) to match all addresses. For the destination, you can specify a protocol and port to identify a specific service (e.g., tcp:22 for SSH).
Owl Telecom wants to restrict SSH access to PortaSwitch server subnet (192.0.2.0/24) and only allow access:
- From their office network (203.0.113.0/24)
- For an admin who works from home (198.51.100.5)
Owl Telecom’s engineer configures the following rules for TCP port 22 (used for server administration via SSH):
- Allow rules for access from 203.0.113.0/24 and 198.51.100.5 to 192.0.2.0/24 on tcp:22
- A block rule to deny connections from all other source addresses (0.0.0.0/0) to 192.0.2.0/24 on tcp:22
This ensures that SSH access is limited to Owl Telecom’s trusted locations, with no additional firewall configuration required on individual servers.
- Sensitive services are accessible only from explicitly defined IP addresses.
- Engineers save time managing access rules for all servers and services in one place.
Peculiarities
- It’s not possible to set a rule where both the source and the destination are set to a wildcard “0.0.0.0/0” (e.g., “block all traffic from anywhere to anywhere”) – at least one side must identify a specific IP address or subnet.
- To apply the “allow” and “block” rules, they should be enabled using the corresponding options NetworkProtection.allow_connections_enable and NetworkProtection.block_connections_enable.
- Access rules take precedence over all other iptables rules – both those automatically generated by PortaSwitch, such as SIP/DB/HTTP protection rules, and those manually added on individual servers.
- PortaSwitch maintains a protected list of its own server addresses, cluster IPs, Docker internal network ranges, and PortaOne support IPs that cannot be blocked by user-configured rules. This ensures that inter-server communication is never accidentally interrupted.
- You can set one of the following actions for each rule type (“allow” and “block”):
- DROP – silently discard the packet
- REJECT – discard the packet and notify the sender
- LOG – log the event without blocking traffic
