[null, {"document_url": "https://help.endian.com/hc/it/articles/218144788-How-to-split-a-zone-in-sub-zones", "unformatted_src": "/attachments/token/ubqfkxttsgvn1ux/?name=Selection_163-mod.png", "src": "https://help.endian.com/attachments/token/ubqfkxttsgvn1ux/?name=Selection_163-mod.png", "alt_text": "Selection_163-mod.png"}, {"document_url": "https://help.endian.com/hc/it/articles/218144788-How-to-split-a-zone-in-sub-zones", "unformatted_src": "/attachments/token/ufb1oTgeRWyq8mYHWoBYmT9sw/?name=interzone-fw.png", "src": "https://help.endian.com/attachments/token/ufb1oTgeRWyq8mYHWoBYmT9sw/?name=interzone-fw.png", "alt_text": "interzone-fw.png"}, null]


Applies to Platform: UTM 2.4, UTM 2.5, 4i Edge 2.5
Updated on: 8th of May 2014

Applies to Platform: UTM 3.0, 4i Edge 3.0

This lesson guides you in the configuration of your Endian Appliance  for splitting a Zone (e.g., the GREEN Zone) with more than one interface in multiple sub-zones with different subnets.
Ususally, Endian Appliances put in a bridge all the interfaces within the same zone - this happens with virtual interfaces (VLAN) as well.
For example br0 (GREEN) may contain eth0, eth1 and those devices you chose as belonging to the GREEN zone.
For many reasons you may want to split a zone in additional sub-zones that do not communicate with each other, but due to the structural limits, you can't remove an interface from a bridge. Fortunately there is a workaround that could mitigate this problem.


We will assign the subnet 10.0.1.0/24 to the Interface 1 (eth0) and the subnet 10.0.2.0/24 to the Interface 2 (eth1)

To fulfil the requirements you can use the Network Configuration Wizard. More information in this lesson.


In this example we use two physical interfaces but the same concept can be straightforward applied using more than two interfaces or even VLAN since they are handled by Linux (and Endian) exactly like interfaces.

Isolate Two Interface in The Same Zone

The first step is the creation of the Inter-Zone rules necessary to isolate the interfaces at Layer 2. We can to do this from the GUI, so go to Menubar > Firewall > Inter-Zone traffic and click on Add a new inter-zone firewall rule. In the above example we created two blocking rules and modified from allow to block the default policy between GREEN and GREEN.
The first rule blocks Layer 2 traffic from Interface 1 to Interface 2, while the second one from Interface 2 to Interface 1.


If you want allow specific IPs from sub-zone 1 (Interface 1) to sub-zone 2 (Interface 2) remind to add the allow rule before the blocking rules we created.

Bind an IP Address or Subnet to the Interface

In the previous section we have isolated the communication between the interfaces but this is not sufficient because for example a client behind the Interface 1 could use the Internet with an IP from the subnet 10.0.2.0/24, while we want to use this subnet only for clients behind the Interface 2. So the idea is to use the custom rules for blocking all the traffic which is not designated to the specific interface and allow only all the traffic designated.

To create the custom rules we need to use the inithooks file rc.firewall.local. For more info on inithooks or if the file rc.firewall.local doesn't exist on your system, please refer to this article.

Now proceed by editing the /var/efw/inithooks/rc.firewall.local file with the editor nano.

root@endian:~ # nano /var/efw/inithooks/rc.firewall.local

In the start section of the file, you should place four iptables rules. In the sample rc.firewall.local file below we have two rules per interface. In the first Interface1 section, the first rule allows the traffic if the source of the traffic comes from the subnet 10.0.1.0/24 and from the Interface 1 (eth0), while the second rule blocks the traffic not destinated to this interface. In the second Interface1 section, similar rules filter the incoming traffic. In the two Interface2 sections, symmetric rules are built to govern the traffic in the opposite direction as in the Interface1 sections.

Limits of This Solution

This procedure is still a workaround and therefore there are some constraints:
