Curriculum / Network firewall
Addressing and routing
Assign IP addresses, add static routes, and understand how the appliance forwards packets between zones.
Goal
Give interfaces addresses, add static routes for networks you don't directly touch, and verify the routing table on the appliance.
Addressing
Each interface needs at least one IP address with a prefix length (for example 10.0.1.1/24). In the console open Network → L3 and add addresses per interface. The appliance configures them on the host when you publish.
Static routes
The appliance automatically knows about directly connected networks. For anything beyond them, add a static route:
- Destination — the network in CIDR form, e.g.
10.20.0.0/16 - Next hop — the router that can reach it, e.g.
10.0.1.254 - Interface — optional, pins the route to an egress interface
A default route (0.0.0.0/0) via your WAN gateway gives the appliance internet reachability.
ECMP
When two next hops can reach the same destination, group them for equal-cost multi-path so flows are balanced across both links. Flows stay pinned to a path so TCP does not see reordering.
Verify
- After publishing, the routing table on the appliance includes your static routes.
- From a
lanhost, a traceroute toward the internet leaves via the WAN next hop you configured.
Pitfalls
- IP forwarding must be enabled in the network settings — without it the appliance receives but never forwards.
- A route is not permission: even with a valid route, inter-zone traffic still needs a firewall rule to pass.