|BOT - Getting started|
First time configuration
Before BOT can be activated we have to configure the PC which will be
used for BOT administration.
You have to enter the BOT settings:
BOT creates a 'default admin access rule' with the MAC as source address and IPCop and the HTTPS Port as destination to guarantee that you don't get locked out from IPCop Webgui. This is the reason why you have to enter 'Admin MAC' and 'HTTPS Port' here.
Default Deny action:
When you hit 'Save' the settings are stored and you can start defining BOT rules and other usefull features. Additional (advanced) features can be configured when you goto Firewall -> Advanced BOT Config in the WebGUI:
First you should define some custom services, you can select those custom services later when you create service groups or your own BOT rules:
There are three custom services defined in the screenshot above:
Next you can define service groups, custom addresses, address grouping or add a new interface:
When you select 'Service Grouping' you will see this:
In the above screenshot following groups are defined:
After defining these custom services and service groups we are set to define our first BOT rules.
So what do we want to achieve? We want to allow internal PCs
We have already defined some service groups to archieve this. So start with the first BOT rule, we allow lan PCs to use the IPCop services.
Go back to BlockOutTraffic section (Webgui -> Firewall -> BlockOutTraffic) and 'Add a new rule'. You will see the following GUI. You can select various options for the firewall rule. The firewall options are grouped into following categories: source, destination, additional settings and timeframe (if the rule should only be activ at a specific time).
So to allow the (green) network PCs to use the IPCop services select as source:
and as destination:
The rule has to be enabled and optionally you can enter a comment.
There are two ways to proceed now, you can hit [Next] or [Save]. With [Save] the rule will be saved and added at the end of your list of BOT rules. With [Next] you will get an overview of the rule options and the possibility to select a position in the list of BOT rules where the rule will be inserted.
If you have hit [Next], you will see this:
You can go [Back] if you want to change an option or hit [Save] to save the rule at the specified positon. At first the position is not that interesting but later, as soon as you have many rules, you may want to insert a rule at a specific position.
The rule is saved and you will see the overview of your current rules:
So the IPCop services available for internal (green network) PCs now. Next create a rule to allow some internet services.
Hit [New Rule] and select the following options.
The rule needs to be enabled and optionally you can enter a comment. Now hit [Save] or [Next]+[Save] and you have your second BOT rule.
Internal PCs are allowed to access the internet with Mail (you can add more services to the "Default services" group later) and use DNS, DHCP, NTP and webproxy on the IPCop.
Your list of 'Current rules' should now look like this:
You are now set to enable BOT. All traffic which is not allowed by your current rules is blocked then.
You may want to allow some PCs to administrate the IPCop box via Webgui or SSH. See next chapter "Further advanced config".
Further advanced config
The first BOT rules are defined and we can go a step further. We define a BOT rule which allows the administration from some internal network PCs.
First we define custom addresses for the Admin PCs in the advanced BOT section 'Address settings':
You see two admin PCs, defined with MAC address in the screenshot above. Similar to custom services you can use those custom addresses in your BOT rules or group them together in a address group.
In the next advanced BOT config section 'Address Grouping' we create a group 'Admins' with the two custom addresses defined before:
Now we are already able to create the admin rule. Go back to the BlockOutTraffic page and hit [New Rule].
Enter the necessary rule options, select as source:
That's all, we are done. Your list of 'Current rules' should now look like this:
|Created 2006 by dotzball | Design by wintermute|