Firewalls in Tower Networking Inc are very simple devices. They operate on a set of rules to sift through traffic and do with it what you see fit. There is no concept of WAN/LAN for these devices so direction of rules will need to be considered.

A network tap is a relatively cheap device that allows you to view traffic going down a wire.
This allows you to get an idea of what traffic is passing through a specific segement of your network.

There is no need to purchase an ETHTapper and a Firewall for the same segment, all Firewalls have Taps built in.




Management traffic is quite noisy so filtering it out is very helpful. Excluding it is helpful to see what you are looking for. See table of traffic types.

Out of the Box Elevator firewalls are incredibly permissive. They will allow all traffic with no restrictions. They are basically a Tap unless you specify otherwise.

Default policy is allow without any other rules.



By default a firewall is not much help. If you are by default allowing all traffic, you will need a lot of rules to prevent the traffic you dont want from passing. As traffic evaluated and dropped does not impact your network bandwidth of the firewall, it could be argued that blocking by default is better.
As with most things, this is situational. Take care with setting up rules, it is very possible to lock yourself out of a firewall. This is where the Datawiper USB comes in as it will factory reset your firewall.

If you are blocking all traffic by default, you will need to explicitly allow only the traffic you want.
If the firewall is sitting in front of your DNS server, you will need to allow DNS requests else the servers will not be able to be reached.

See section below for modifying management traffic to switch to Default Deny without blocking management traffic.

Network port tcp/23 is very important. It allows you access to managing your firewall.
I recommend adding your debug device as a rule to allow access to the server as a first step.

tcp/23 can also be used by maliscious users to poke your hardware. Hacker activity is still being researched and is ever evolving.

(This assumes your debugger is named @Debug and your firewall is named @Firewall. Modify accordingly.)




If you loose access, use the reset USB. You messed up somewhere.

(Credit to Thorinbur for List.)

Type

Name

Used by

tcp/510 to tcp/519

Worm Transmission

Malicious!

tcp/8000 to tcp/8099

Text Scraping

Malicious!

(Credit to Thorinbur for List.)

After unlocking SFTP, its possible to view and copy the software on firewalls to servers and other devices. This allows you to run firewall rule processing on a server directly instead of relying on a dedicated firewall to do so.

This feature is newer and is still being developed. Once more is known, I will work on a guide explaining using hardware Firmwares on non firewall hardware.