Hello,
I am looking into how to update the firewall on a Compact-S PLC with AS6 during runtime. I want to be able to open/close a specific port.
I have found the ArFirewall library, which allows for creating a new rule or deleting all rules. I have many different firewall rules in my project, but only want to change one of them during runtime. Is the intended use that I delete all firewall rules and then recreate all my firewall rules with the one specific change (e.g. open/close port)?
I am concerned by the fact that when all firewall rules are deleted, then the firewall allows all network traffic. That means that the PLC is open to all traffic whilst the firewall rules are being remade.
Is there a different way to open/close a specific port during runtime? Or is this the best approach?
Thanks in advance!
Hello,
The description of ArFirewallDeleteAllRules is clear here
Function block ArFirewallDeleteAllRules can be used to delete all firewall rules. After deletion, the firewall allows all network traffic.
However, according to the CRA, all unnecessary services should be disabled anyway, and all others should be accessible only after authentication.
We would need to consider in detail what the worst-case scenario actually looks like, since reconfiguring the firewall will surely take only a few seconds.
If necessary, you could perhaps set an invalid IP address using CfgSetIPAddr() before reconfiguring, so as not to make it too easy for an attacker.
Some ports can be influenced with functions from the AsArCfg library like DNS, DHCP, FTP.
In AS6 some ports can be blocked with a configuration setting:
Thank you both for the quick replies!
I can see that I did not describe my problem enough initially.
I am in a situation, where I am using IF3 for an internal network and IF2 for an external network. I always want the ports for the internal network to be open, but want to be able to open/close ports on the external network. Therefore, I cannot disable the services/interfaces that are required for the internal network. There is of course also authentication for all services/interfaces, but removing the service/interface entirely from the external network when it is not used is desired.
I guess it would be an option to use CfgSetIPAddr() to set an invalid IP for IF2 whilst keeping the IP for the internal network. Then once the firewall settings have been updated then set the IP for IF2 to the previous IP. But to me this feels more like a workaround than a proper solution. I will give it a try anyways 
It would be nice if you could delete only a single firewall rule using the ArFirewall library though.
I can see that I did not describe my problem enough initially.
No, I think we got it and you point to a reasonable request.
It would be nice if you could delete only a single firewall rule using the ArFirewall library though.
I agree. In that case, you should contact your local B&R office so they can create a product request.
