The Artica firewall filters the traffic that reaches the appliance, leaves it, or crosses it when Artica acts as a gateway.
It is built on the Linux kernel firewall (iptables / netfilter) and is entirely managed from the Web console: you describe rules, Artica turns them into kernel rules and keeps them in place.
Enable it as soon as Artica is exposed to the Internet (Reverse-Proxy, WordPress, RDS Proxy, mail gateway) or when it routes traffic between networks.
Understanding these five points avoids most surprises:
- One writer, one transaction
Every change is applied by the Artica service in a single kernel transaction.
There is never a moment without filtering: either the new rule set is accepted as a whole, or the previous one stays in place and you are notified.
- Changes are applied automatically
There is no "Apply" step to remember: about 6 seconds after your last change, the firewall is rebuilt.
The badge at the bottom of the rules table shows when the rules were last applied and whether a rule was refused by the kernel.
- Rules belong to interfaces
A network interface must be linked to the firewall before its rules are active.
Interfaces that are not linked fall back to a permissive "all interfaces" policy.
- Protection modules keep a fixed order
Local rules, the anti-flood rule, trusted networks, CrowdSec, the SSH black list, GlusterFS, DecisionIP and the proxy schedule are always evaluated in this order, before your interface rules.
- Other software is left alone
Rules added by Docker, Fail2ban or other services are never removed by a rebuild.
See How the firewall applies your rules for details.
- Enable the firewall
Install the feature and find the Your Firewall menu.
- Link your interfaces to the firewall
Choose which interfaces are filtered, their incoming and outgoing default policies, behavior (LAN/WAN),
ping policy, masquerading, DDoS and DHCP protection,
and the policy for traffic crossing the appliance between two interfaces.
- Firewall rules
Create, order and monitor the rules: actions, services, objects, time restrictions, connection limits,
sections, logging, packet counters, unused and hidden rules.
- How the firewall applies your rules
Automatic application, refused rules, rule order, trusted networks, what survives a rebuild.
- IPv6 filtering
The same rules, policies and objects applied to IPv6, what stays IPv4 only, IPv6 trusted networks.
- Firewall services
Named sets of protocols and ports (ssh, https, dns…) used by the rules.
- Firewall objects
Groups of addresses (IPv4 and IPv6), networks, countries, host names (FQDN) or DNS zones used as rule sources or destinations.
- Dynamic DNS object
Feed an object with the records of a DNS zone.
¶ Routing, translation and gateway functions
- Network address translation (NAT)
Destination NAT (port forwarding), reachable from the internal network with the public address (NAT reflection), source NAT, redirection.
- Masquerading
Let a network reach the Internet behind the address of an Artica interface, for chosen source networks,
with excluded destinations or per-source rules.
- Interface connectors
Link two interfaces to make a routed bridge between two networks, with dedicated firewall rules.
- Link balancer
Spread traffic over several Internet links and switch over when a link fails.
- Traffic shaping
Limit the bandwidth of addresses or networks.
- Duplicate traffic to a target address (MIRROR)
Send a copy of the traffic to a sensor.
¶ Filtering by origin and threat
¶ Monitoring and administration
- Firewall events and configuration view
Blocked and logged packets with the rule that decided, the most active rules,
sources and ports, the current rule set as text.
- Packet tester
See which rule of the active firewall decides what happens to a packet.
- Configuration history and change confirmation
Every applied version is kept; a change that is not confirmed in time is rolled back automatically,
so a wrong rule cannot lock you out.
- Draft and preview
Prepare several changes without applying them, see the kernel rules they would produce,
then apply or discard them in one step.
- Export and import a configuration
Copy the firewall of an appliance to another one,
with an interface mapping, through a draft.
- Firewall REST API
Manage rules, NAT, masquerading and interfaces from scripts.