Firewall

Firewall Use Cases

Most common to use is Port Forwarding and Inbound Traffic Block.

• Port Forwarding is if you want to open a port from WAN and forward the traffic to a local device
• Inbound Traffic Block block access from a specific address and/or destination
• Forwarding Traffic Block allow/block devices from your local network
• Services Choose which Ports on SPR are accessible

Advanced firewall configuration

• Custom Interface Access - Join a docker bridge or custom interface to SPR networking
• Multicast Proxy -- Configure mDNS, SSDP, and other UDP broadcast services
• Endpoints - Define one-way connectivity rules
• ASN / Geo Blocking - Block traffic by country code or ASN
• SPR Outbound Block - Block traffic originating from the router itself

Port Forwarding

Set rules to forward incoming traffic (DNAT forwarding).

Add a Port Forward

On the Firewall page expand Port Forwarding and click Add Forward.

In the screenshot all traffic from source address 1.1.1.1 with destination port 8080 is redirected to 192.168.2.106 on port 8080.

Inbound Traffic Block

Block traffic coming into the network at the PREROUTING stage.

Add a Inbound Block

On the Firewall page expand Inbound Traffic Block and click Add IP Block.

In the screenshot all traffic from source address 1.1.1.1 with destination address 192.168.2.106 will be blocked.

Forwarding Traffic Block

Add rules to block traffic at the FORWARDING stage.

Add a Forwarding Block

On the Firewall page expand Forwarding Traffic Block and click Add Forwarding Block.

In the screenshot all traffic from source address 192.168.2.103 with destination address 192.168.2.106 on port 8080 will be blocked.

An example use case would adding the LAN policy to a device but wanting to block access on some outgoing ports or IPs.

Custom Interface Access

Manage network access for custom interface names and control access for docker networks.

Use this to forward traffic to an interface running in a separate container.

See more in the repository for the spr-mitmproxy plugin for how this feature can be used.

Multicast Proxy

Set multicast ip:port addresses to proxy between devices. This allows discovery services such as SSDP/Zeroconf and mDNS in SPR. By default only SSDP and mDNS are on. You may need to enable PTP or other services for streaming and device sync. If something is not working as expected, let us know, by filing an issue

Optionally, a tag can be applied to a service to apply proxying to only a subset of devices that have the same tag.

Endpoints

Service Endpoints serves as helpers for creating other firewall rules, as well as one-way connectivity from devices to the endpoint when they share a tag.

When devices are in the same group they have full access to each other. Device with the LAN policy have one-way access to all devices via NAT.

Endpoints create a quick way to apply one-way connectivity a specific destination, by applying tags.

1. Create an Endpoint definition

2. Apply a tag

3. Apply the same tag to the device that should have access to the endpoint

4. Example of device access before and after it has the tag

The other side, 192.168.2.58, does not gain access to the device on 192.168.2.218 beyond receiving TCP connections on :22900.

ASN / Geo Blocking

The ASN/Geo Block tab lets you drop inbound traffic based on where an address is registered, either by two-letter country code or by Autonomous System Number (ASN). Matching source ranges are programmed into an nftables set (geo_block) so packets from those addresses are blocked in the filter table.

Geo blocking relies on the lookup plugin to turn a country code or ASN into IP ranges. The API queries the plugin over its unix socket (for example /country_ranges/US and /asn_ranges/13335), so the plugin must be installed and running for blocks to resolve to ranges. You can optionally enable external lists, such as the Spamhaus ASN-DROP feed, whose ASNs are also resolved through the lookup plugin.

Blocking is only enforced while the feature is enabled. When it is disabled the geo_block set is flushed.

Block a country or ASN

Open the ASN/Geo Block tab and enable geo blocking, then add entries:

• To block a country, search for it and select it. This calls PUT /firewall/geo_block/country/{cc} where {cc} is the two-letter ISO country code (for example RU). Remove it with DELETE on the same route.
• To block an ASN, enter the AS number and add it. This calls PUT /firewall/geo_block/asn/{asn} (for example /firewall/geo_block/asn/13335). Remove it with DELETE on the same route.

The full configuration (enabled state, denied countries, denied ASNs, lists, and refresh interval) can also be read or replaced at GET/PUT /firewall/geo_block/config.

Refresh behavior

Any change to the configuration triggers a refresh that re-resolves ranges and reprograms the set. In the background, SPR re-fetches ranges on an interval controlled by RefreshSeconds (default 86400 seconds / 24 hours, minimum 3600). Resolved ranges are cached to disk and restored on startup so blocking survives a restart even before the next refresh.

To force an immediate refresh, use the refresh control in the UI, which calls PUT /firewall/geo_block/refresh. The current state, including how many ranges are programmed and per-source counts or errors, is available at GET /firewall/geo_block/status.

SPR Outbound Block

The SPR Outbound Block tab blocks traffic that originates from the router itself (egress from SPR), rather than traffic passing through it from your devices. Use it to stop SPR from reaching a specific external address or service, for example to keep the router from contacting an upstream endpoint while still allowing your LAN devices to route normally.

Add an outbound block

Open the SPR Outbound Block tab and add a rule:

• Block SPR from connecting to - the destination address the router should not reach (DstIP).
• Destination Port - the port to block; leave empty for all ports (DstPort).
• Protocol - tcp or udp (required).
• Description - an optional label.
• Under Advanced, From (router source) sets the router source address (SrcIP), which defaults to 0.0.0.0/0 (any) and is usually left as-is.

Saving calls PUT /firewall/block_output; removing a rule calls DELETE /firewall/block_output with the same fields.

Services

The services view controls firewall settings for the SPR router itself. The Ping settings control if SPR can be pinged. These are on during setup but disabled by default after.

Working with Service Ports

The allowed SPR services are default on for all devices. In a future release tag support will be improved to further restrict port access to the API (tcp 80) and SSH (tcp 22) on SPR.

To remove access for LAN devices, delete the service entry.

To allow access to the service from the Uplink interface, turn the slider to on ("Upstream WAN").

Multicast Settings

SPR uses a multicast UDP Proxy to relay multicast traffic between devices.

Set the "Enable Multicast Proxy" to false to disable the proxy and all mDNS settings.

The "Advertise Router over mDNS" toggles whether or not the proxy will respond to mDNS name requests on the uplink interfaces.

This makes it possible to discover SPR with querying 'spr.local' on systems that are aware of mDNS.

The mDNS name can also be customized.