Basics for Firewall Hardening

If you're like me and want to harden your OMV instance while not losing functionality, I have some tips for you.

General Rules of thumb to get started:
-Rules will be geared towards ingress/inward/inbound/input traffic. Since egress/outward/outbound/output traffic is coming from your NAS, which you already trusted enough to put on your network.

-Due to some protocols having back-and-fourth handshakes that involve "ephemeral ports" there will be some near-identical rules that have minor tweaks. Both rules have to be in your list. Example: if the port initiates on source port 443, and your NAS randomly decides it likes ephemeral port 52525 to handle it, then it may circumvent your one allow rule.

-Some basic knowledge of CIDR IP Addressing is very helpful, so study up. 0.0.0.0/0 means "anything". We will use this instead of leaving blanks in some rules, because it isn't always clear if the service is talking to 127.0.0.1 (Loopback) OR to your device's IP (192.168.0.x). Firewalls are generally facing the device IP and not the Loopback, so if you leave it blank you can lock out some services. 192.168.0.1/24 means all IP addresses from 192.168.0.1 to 192.168.0.255. Change according to your network.

-We will be using "Drop" instead of "Reject", because it's best practice in I.T. "Drop" means the person on the other end isn't even sure if they hit an endpoint/server/etc. "Reject" will let them know for sure they did.

-Firewall rules follow "top down", so use the navigation arrows at the top to prioritize them. You don't want your "lock everything out" at the top, because then it won't let you in even!

-Before you get into the weeds, create rules so you don't lock yourself out of the web browser. Please position these two at the top of the list as you go.

Examples:

=============================================================================================================================

Create the following to deny all inbound traffic and put it at the bottom of your list:

Create the following to allow SSH from home network:

Create the following to allow PING from home network:

Create the following to allow SMB/SAFT from home network:

Create the following to allow DLNA from home network:

Create the following to allow NTP (For time syncing):

*NTP is Net Time Protocol and is CRITICAL in services and features talking to each other. If your time sync is more than 5 minutes off, then nothing will work.

Create the following to allow SMTP (For Notifications):

*The four rules involving Destination and Source port 25 are for the Loopback Mail server (127.0.0.1:25 and [127.0.0.1]:25) to spin up to prepare the email. Source port 587 is for the Email Provider (E.G. Gmail) to be able to request the information and send it. A mixture of UDP and TCP is necessary, as these protocols alter depending on which information is being exchanged.

Create the following to allow HTTP (For Updates):

*Some services update over HTTP-only, so it's unavoidable. You need this one.

Create the following to allow HTTPS (For NGINX and Secure Updates):

*NGINX is vital on your computer as a lot of background processes will use HTTPS. NGINX is a web server that your NAS can spin up for mass exchanges. This rule also supports secure server updates.

Create the following to allow DNS (For Website Resolution):

*DNS is vital, because everything on your NAS will attempt to find a website. If you do notifications it may try to resolve smtp.google.com or if you have clamav it may try to find the clamav domain to update its signatures. you NEED this.

Create the following to allow uPnP (For Local Network Discovery):

*uPnP is vital, because certain services like SMB/CIFS and DLNA need to discover each other for proper access.

After the above are input, and the Deny All rule is at the bottom, you'll have a pretty secure box! Only vital traffic is allowed, and you can create new rules as you go for additional plugins and services. I find when most people "break" something with OMV Firewall, they forgot the DNS, NTP, or HTTP rules. Read your syslogs, people!

P.S. if your SMB Share is only reachable by IP address instead of Hostname after you put up a firewall you can do one of two things:
A) Edit your "Hosts" file to have a record that force resolves the Hostname to IP address. *Make sure your antivirus won't overwrite your change ~cough~ Bitdefender ~cough~

OR

B) Add an "A Record" in your Router or DNS server to resolve the Hostname to IP Address.