Firewall for Workplace¶
The Firewall for Workplace module lets you define network filtering rules and apply them to user groups published in Workplace. Rules run on the extended VDI desktop when a user opens a session, and block or allow communications according to the profile assigned to the user's group.
An administrator uses it to confine some groups (subcontractors, third parties, sensitive populations) to a subset of networks or ports, or conversely to authorise specific flows.
Conditional visibility
The screen only appears when the Workplace association is active and console merging is active too — both are set in Workplace association.
Concepts¶
- A firewall rule describes a flow to block or allow: addresses, ports, protocol, direction.
- A firewall policy maps one or several user groups to one or several rules. When several rules apply to the same user, they are merged.
- A default behaviour applies when no rule matches.
The screen exposes a toolbar with Configuration (default behaviour) and two tabs: Firewall rules and Firewall policies.
Default behaviour¶
Click Configuration in the toolbar. The Default behavior configuration window lets you set independently, through two radio buttons each:
| Direction | Choices |
|---|---|
| Incoming traffic | Block (default) or Allow. |
| Outcoming traffic | Block (default) or Allow. |
Click Validate to save. This behaviour applies to any connection that does not match a rule.
Firewall rules¶
The Firewall rules tab lists the existing rules:
| Column | Description |
|---|---|
| Name | Unique label of the rule. |
| Addresses | All, or the list of retained addresses and ranges. |
| Ports | All, or the list of retained ports and ranges. |
| Protocol | All, TCP, UDP, GRE, HOPOPT, ICMP, IGMP, IPv6-ICMP, IPv6, IPv6-Frag, IPv6-NoNxt, IPv6-Opts, IPv6-Route, L2TP, PGM, VRRP. |
| Action | Block or Allow. |
| Traffic | Outbound or Inbound. |
As long as no rule exists, the grid shows No firewall rule. The search field, whose placeholder is Search, filters the list; the grid footer offers an Items per page: selector set to 15, 25 or 50.
Add a rule¶
Click +. A three-tab window opens.
| Field | Description |
|---|---|
| Name | Mandatory and unique among rules. |
| Action | Block (default) or Allow. |
| Traffic | Outbound (default) or Inbound. |
Choose between All addresses (default) and Specific addresses. The second choice enables a one-column grid, Affected addresses, topped by three actions whose tooltips are New address range, Edit and Delete; while it is empty it shows No address affected. — and the rule then covers every address.
A Protocol drop-down, set to All by default. The choice between All ports (default) and Specific ports is only offered for a protocol that has ports. The second choice enables a one-column grid, Ports concerned, with the same three actions as above; empty, it shows No port affected.
In create mode, Previous and Next buttons guide through the tabs. The Validate button is only active on the last tab.
Edit a rule¶
Select a row and click the Properties icon (or double-click). In edit mode, tab navigation is free — each tab must be valid to move to the next.
Delete a rule¶
Select one or several rows and click ×. A confirmation is requested. Multi-selection is supported.
Firewall policies¶
The Firewall policies tab lists user-group / rule pairs. Its toolbar carries only two actions, Add and Delete: a policy is not edited, it is deleted and recreated. As long as there is none, the grid shows No firewall policy.
| Column | Description |
|---|---|
| User group | Workplace user group involved. |
| Rule | Rule applied to the group. |
Add a policy¶
Click +. The window unfolds across two tabs.
Drag and drop the desired groups from the left list to the right one. Only groups published in Workplace are available. Click Next.
Drag and drop the desired rules to the right list. Click Validate.
The policy is created for every group × rule combination of the selection.
Delete a policy¶
Select one or several rows and click ×. A confirmation is requested.