Simple settings

There are a number of one-off simple settings in the main setup page.

Save config

This allows to you save the configuration to your local hard disk. Click on this and your browser should give you the option of a filename to save the file to. You will only be able to save if you have the appropriate security level.

Note that saving the config also clears the log.

Upload

You can upload new software or saved configuration files using this option. Uploading a configuration will replace the existing configuration, and is only available if you have the appropriate security level.

To upgrade the FireBrick® you must first download the software file(s) from http://software.FireBrick.co.uk/ and store these on your computer. You can then select the upload option and select the file to upgrade your FireBrick®. The upgrade process can take up to a minute during which time the red light will flash rapidly and all of the LAN hub lights will flash. When they stop the FireBrick® is upgraded.

You must not interrupt the power during the upgrade. If you do you could end up with a dead FireBrick® (see Don't Panic).

An upgrade will not normally change your configuration or reset statistics or DHCP tables, but this depends on the versions you are using. Always check your configuration carefully after an upgrade. It is usually a good idea to save your config before upgrading, as downgrading later may not preserve your config fully.

Once the main (F) file is loaded, you will need to load the user interface file (e.g. WEN for English). WIthout this the FireBrick® still operates, but cannot be configured.

Note that uploading also clears the log.

Clear Alert

This is only shown if the red light is slowly flashing, meaning an alert has been set by the filtering rules. Click on the link to stop the light flashing. If the clock is set, then the date and time of the alert is also shown.

Hub LEDs

This setting allows you to control the meaning of the yellow and green lights on the four LAN ports. Various options allow the status of the network connection to be displayed in different ways. The default is setting 2 which shows activity and link status in the same way as the WAN lights.

Options include a bar graph mode which uses the 8 lights as a usage level indicator - lighting more lights from the left. When in a wall of FireBrick®s this allows network usage per FireBrick® to be seen at a glance.

Another option is a cycling lights option. Note that selecting this does cause a harmless local network packet to be sent on the WAN connection every 1.5 seconds, which would not go out to the internet. If you have a wall of FireBrick®s you can select cycling lights on all of them at once and you will be able to see what this network packet is used for...

Name

You can name your FireBrick®! If you have to administer several FireBrick®s then it is sensible to name each one so that you can see at a glance which one your are configuring. The name appears at the top of the screen along with the serial number. You can also supply a Domain which is used by DHCP.

Gateway

When deciding where to send a packet of data the FireBrick® first checks the routing rules, then the local subnets and finally the default gateway route. Set this to the address of your main gateway to the internet. This is normally the IP address of your router.

The gateway only affects routed traffic, and not stealth traffic, so if it is not set the FireBrick® will work in stealth mode and will only communicate with local networks. It is important to set the gateway address when the FireBrick® is being used as a router (with or without NAT) and is treated as a gateway itself by local computers. It is also important to set this when the FireBrick® needs to know the time of day itself and the time server is on an external machine (as it will be if the default time server is used).

If the FireBrick® is a DHCP client on the specified interface then the gateway is normally set automatically. To remove the gateway, set the address to 0.

Stealth IP

The FireBrick® configuration pages work on the web page http://my.FireBrick.co.uk/ or the IP address 217.169.0.1. This is a real internet address which we have reserved for the purpose. When accessing the FireBrick® configuration pages the FireBrick® intercepts the access to this address. It effectively borrows this address for its own use.

You can change the address that is intercepted, but it is unlikely you will ever need to. If you have given your FireBrick® a real IP address then you may not want to allow any interception, in which case set this address to 0. Please test access to the configuration pages using a real IP address before you do this as you might otherwise be completely locked out (see Don't Panic).

You can also set an address for the WAN stealth operation. This is an address that the FireBrick® borrows for things it sends to the internet itself, such as time requests. It is only necessary if you are not giving the FireBrick® one of your real IP addresses, in which case it should be set the the address of a computer on your network which will normally be switched on. The FireBrick® only borrows this address for specific communications such as time setting requests, and will not normally interfere in any way with the operation of the machine whose address is borrowed. If you do not set this address, or set it incorrectly, then some functions will not work in stealth mode (such as time setting from an external server).

Note: Setting the stealth IP is not the way to give the FireBrick® an IP address. If you want the FireBrick® to be on your network with a normal IP address, use the subnets menu.

Time setting

For logging and for profiles to operate on a time basis properly the FireBrick® must know the time of day and day of week. Being connected to the internet this is done using time servers on the internet.

In order for the time setting to operate the FireBrick® must know a route to the internet (set the default gateway route) and if it has no IP of its own then it must have one defined (stealth WAN IP address). Once this is set the FireBrick® can set the time automatically. The status screen will show if the time is set.

The default time servers are time-a.nist.gov and time-b.nist.gov, two US government time servers.

The time server uses standard internet RFC868 time protocol on UDP port 37. It sets the time once per hour at an arbitrary time during the hour. You can configure a time profile to restrict this to certain times of day and days of week if you prefer (useful if you have an ISDN router and intranet access costs call charges). On power up the time is also set. If the FireBrick® cannot set the time it will keep trying for 2 minutes, and then give up for about an hour before trying again. Once the time is actually set will it stick to the time profile you have selected.

Note that you may find you are logged out as soon as the clock is set for the first time (e.g. just after setting the gateway). This is normal - the FireBrick® thinks you have been logged in for 30 years and times you out!

Syslog IP

syslog is a system logging protocol. To use this you will need a syslog program. This is standard on unix systems (but may require the -r option to allow remote syslog). There are also syslog programs available for Windows.

Once you have a syslog server set up you can set the syslog IP address for that server. This will log various system messages from the FireBrick®. You can set network filters to generate logs when specific traffic is rejected or accepted.

DNS

The FireBrick® acts as a DNS relay. This means that it will accept requests to look up names on the internet, and send these on to a real DNS server. You can set all of your machines on your network to use the FireBrick® as the DNS server, and set the FireBrick® to relay these to a DNS server provided by your ISP. Simply enter the DNS server address you require.

If the FireBrick® is a DHCP server then it gives its own address as the DNS server, and relays requests to the real DNS server.

Log/Filter Options

The log options control when and where log entries are created for various types of event. This also controls what happens if there is no match in the packet matching - this allows you to allow, drop, reject, or bounce unknown connections generally.

The stealth controls allow you to turn off various aspects of stealth operation. These are for advanced use. If you are using the FireBrick® only as a router, you can turn off stealth completely.

The default filter controls the logging of sessions that do not match any other filter, and importantly, this also controls whether the session is allowed or not.

A number of other system events can cause logging :-
 
Event General event (e.g. FireBrick power up)
Alert Unexpected event (e.g. duplicate IP seen on network)
Debug Additional information, particularly DHCP and unexpected ARP events
Login OK When someone logs in
Login Bad When someone fails to log in
DHCP OK Normal DHCP events, such as allocation of an IP address
DHCP Bad Problem DHCP events, such as duplicate IP, unable to set an address, etc
Ping scan Machines going on and off line as a result of profile monitoring
Large sessions Sessions where more than a specified amount of traffic was transferred

You can also set the server IP address for emailing (where filter/log option Email is selected). You can set the from and to address of the email, and some hold off times. The first time is a hold off before sending an email - allowing other emailable log events to be included in the email. The second is a hold off after the email - allowing you to ensure you don't get a flood of emails. You can also restrict emails to certain time periods. Note that once within the time period, any emailable entries in the log are emailed, even if caused outside the time period - but this would all be in one email to catch up with the log. The log has a finite size, and data may be lost from the log if the delay before sending is too long.

UI Options

A number of the User Interface options can be set :-
 
Pad IP to three digits If set, all IPs are padded to 3 digits, e.g. 001.002.003.004 instead of 1.2.3.4
Also, ranges are shown in full, e.g. 192.168.001.000-192.168.001.255 instead of 192.168.1.0-255
Note, you cannot normally type such address in to a computer as it may see them as octal.
Number grouping All numbers over 1000 can be grouped with a comma, dot, or space. e.g. 23,656,232 instead of 23656232
This makes logs showing amounts of data transferred easier to read.
Decimal point When decimal values are shown, the decimal point can be a point or a comma
Date format The date can be ISO (2000-02-28), US (2/28/2000), UK (28/2/2000) or full (28th February 2000)
Protocol input You can select protocols on filters, etc, using a basic pull down menu giving the choices Any/ICMP/UDP/TCP, a pull-down menu giving a full list of protocols, or an input box in which to type the protocol number.

Security

The security option is described in user security.