Firewall configuration object. The {{param|Config}} parameter enables and disables the Firewall, and can select either a predefined configuration ({{enum|High|Config}} or {{enum|Low|Config}}) or an explicitly-defined {{enum|Advanced|Config}} configuration. For an {{enum|Advanced|Config}} configuration, {{param|AdvancedLevel}} controls the currently active Firewall Level, and the Firewall Levels are defined in the {{object|Level}}, {{object|Chain}} and {{object|Chain.{i}.Rule}} tables. The Firewall rules modeled by this object operate only on the forwarding path. This means that they affect only routed traffic, and do not affect traffic that is destined for or generated by the CPE. Note that any {{object|#.NAT}} processing on the ingress packet occurs before Firewall rules are applied so, for example, the Firewall rules will see the translated destination IP address and port in a downstream packet that has passed through the NAT. See {{bibref|TR-181i2|Appendix VIII}} for an example {{enum|Advanced|Config}} configuration. Enables or disables the Firewall. Firewalls often implement additional Denial of Service and other vulnerability protections, such as those described in {{bibref|ICSA-Baseline}}. If a {{enum|Stateful|Type}} Firewall is enabled, then it is assumed that all implemented stateful protections are enabled, unless they are overridden by some other part of the data model. How this firewall is configured. {{enum}} Vendors can extend the enumerated values with vendor specific extensions, in which case the rules outlined in {{bibref|TR-106|Section 3.3}} MUST be adhered to. The firewall implements the "Traffic Denied Inbound" and "Minimally Permit Common Services Outbound" components of the ICSA residential certification's Required Services Security Policy {{bibref|ICSA-Residential}}. If DoS and vulnerability protections are implemented {{bibref|ICSA-Baseline}}, these are enabled. All Outbound traffic and pinhole-defined Inbound traffic is allowed. If DoS and vulnerability protections are implemented {{bibref|ICSA-Baseline}}, these are enabled. All Inbound and Outbound traffic is allowed, and the CPE is only protected by NAT settings (if supported and enabled). If DoS and vulnerability protections are implemented {{bibref|ICSA-Baseline}}, these are disabled. {{obsoleted|2.14|because it is the same as setting {{param|Enable}} to {{false}}}} Advanced firewall configuration applies, as specified by {{param|AdvancedLevel}}. Selects the currently active Firewall Level. {{param}} only applies when {{param|Config}} is {{enum|Advanced|Config}}. Firewall Type. {{enum}} A {{enum|Stateless}} Firewall treats each packet individually and thus has no concept of sessions. Therefore a {{enum|Stateless}} Firewall cannot distinguish between unsolicited downstream traffic and downstream traffic in response to outbound messages. This means that it has to accept all incoming downstream traffic. Furthermore, because a {{enum|Stateless}} Firewall treats each packet individually, it does not provide any DoS or vulnerability protections. A {{enum|Stateful}} Firewall maintains state about previous packets and thus supports sessions. Therefore a {{enum|Stateful}} Firewall can distinguish between solicited and unsolicited downstream traffic. In a {{enum|Stateful}} Firewall, explicitly configured rules only apply to unsolicited traffic, and can not cause packets received in response to an upstream request to be dropped. Furthermore, because a {{enum|Stateful}} Firewall maintains state, it can provide DoS and vulnerability protections. A device that has a {{enum|Stateless}} Firewall depends on the NAT to provide protection against unsolicited downstream IPv4 traffic. This is because, as noted above, a {{enum|Stateless}} Firewall has to be configured to accept all incoming downstream traffic. For IPv6 there is no NAT, so a {{enum|Stateless}} Firewall can not provide simple security protections against unsolicited downstream IPv6 traffic. The Firewall only implements stateless packet inspection. The Firewall implements stateful packet inspection. A string identifying the firewall settings version currently used in the CPE, or {{empty}} if the firewall settings are not associated with a version. The time at which the firewall settings most recently changed. {{numentries}} {{numentries}} Firewall Level table. When an {{enum|Advanced|#.Config}} configuration is selected, {{param|#.AdvancedLevel}} selects the currently active entry in this table. Each {{object}} table entry references the {{object|#.Chain}} that contains the rules for this level. {{datatype|expand}} Human-readable name associated with this {{object}} entry. Human-readable description associated with this {{object}} entry. Position of the {{object}} entry for user interface display; levels can be presented according to an increasing or decreasing level of security. When this value is modified, if the value matches that of an existing entry, the {{param}} value for the existing entry and all greater-valued {{param}} entries is incremented to ensure uniqueness of this value. A deletion causes {{param}} values to be compacted. When a value is changed, incrementing occurs before compaction. The value of {{param}} on creation of a {{object}} table entry MUST be one greater than the largest current value. The Chain containing Firewall Level Rules associated with this {{object}} entry. On creation of a new {{object}} entry, the device will automatically create a new {{object|#.Chain}} table entry that this {{param}} parameter will reference. Indicates whether NAT port mapping is enabled or disabled when this is the active Level. For a {{enum|Stateless|#.Type}} Firewall this can be set to {{false}} to force any port mappings to be operationally disabled (for a {{enum|Stateful|#.Type}} Firewall this is not necessary because the same effect can be achieved via Firewall rules). This parameter affects all the interfaces on which NAT is enabled. It operationally enables or disables port mapping functionality and therefore does not affect the individual {{param|##.NAT.PortMapping.{i}.Enable}} settings. Note that the current NAT status and NAT port mapping status are indicated by the {{param|##.NAT.InterfaceSetting.{i}.Status}} parameter. Default action for packets not matching any of the level rules. {{enum}} The firewall discards packets matching this rule. The firewall forwards packets matching this rule. The firewall discards packets matching this rule, and sends an ICMP message to the originating host. Enable or disable logging, in a {{object|##.DeviceInfo.VendorLogFile}}, of packets not matching any of the level rules. Firewall Chain table. Each entry contains an ordered list of {{object|Rule}} objects which can themselves reference other {{object}} instances. A hierarchy of rules can therefore be created. A given Firewall Chain's rules are all created by the same entity, as indicated by the {{param|Creator}} parameter. Enables or disables this {{object}} entry. {{datatype|expand}} Human-readable name associated with this {{object}} entry. Creator of this {{object}} entry and of its {{object|Rule}}s. {{enum}} Note that this is the entity that originally created the {{object}} entry. The value of this parameter does not change if the {{object}} entry or one of its rules is subsequently changed by another entity. The {{object}} entry is present in the factory default configuration. The {{object}} entry was created as a side-effect of a {{bibref|UPnP-IGD:1}} or {{bibref|TR-064}} port mapping. The {{object}} entry was created by {{bibref|UPnP-IGD:2}} WANIPv6FirewallControl. The {{object}} entry was created by the Auto Configuration Server. The {{object}} entry was created by device user interface or command line interface. The {{object}} entry was created by another entity. {{numentries}} Firewall Rule table. Each entry defines a Firewall packet selection rule. The {{param|Target}} parameter defines the action to perform for traffic matching this rule: the packet can be dropped, accepted, rejected or passed to another {{object|#}}. This table MUST NOT contain dynamic Firewall rules associated with {{enum|Stateful|##.Type}} Firewall sessions. All entries are created by the creator of the parent {{object|#}}, as indicated by its {{param|#.Creator}} parameter. {{object}} entries in a {{object|#}} with a {{param|#.Creator}} of {{enum|Defaults|#.Creator}}, {{enum|ACS|#.Creator}}, {{enum|UserInterface|#.Creator}} or (maybe) {{enum|Other|#.Creator}} are referred to as ''Static'' {{object}}s. Whether or not a {{object}} in a {{object|#}} with {{param|#.Creator}} {{enum|Other|#.Creator}} is regarded as ''Static'' is a local matter to the CPE. Some of this object's parameter descriptions refer to whether a {{object}} is ''Static'' when specifying whether or not the parameter value can be modified. For enabled table entries, if {{param|SourceInterface}} is not a valid reference and {{param|SourceAllInterfaces}} is {{false}}, or if {{param|DestInterface}} is not a valid reference and {{param|DestAllInterfaces}} is {{false}}, then the table entry is inoperable and the CPE MUST set {{param|Status}} to {{enum|Error_Misconfigured|Status}}. Enables or disables this {{object}} entry. The status of this {{object}} entry. {{enum}} The {{enum|Error_Misconfigured}} value indicates that a necessary configuration value is undefined or invalid. The {{enum|Error}} value MAY be used by the CPE to indicate a locally defined error condition. Position of the {{object}} entry in the order of precedence. A value of ''1'' indicates the first entry considered (highest precedence). For each packet, the highest ordered entry that matches the rule criteria is applied. All lower order entries are ignored. When this value is modified, if the value matches that of an existing entry, the {{param}} value for the existing entry and all lower {{param}} entries is incremented (lowered in precedence) to ensure uniqueness of this value. A deletion causes {{param}} values to be compacted. When a value is changed, incrementing occurs before compaction. The value of {{param}} on creation of a {{object}} table entry MUST be one greater than the largest current value (initially assigned the lowest precedence). {{datatype|expand}} Human-readable description associated with this {{object}} entry. Action to perform for traffic matching this {{object}} entry. {{enum}} This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). The firewall discards packets matching this rule. The firewall forwards packets matching this rule. The firewall discards packets matching this rule, and sends an ICMP message to the originating host. The firewall doesn't consider the remaining rules (if any) in the current chain. The rules in the chain referenced by the {{param|TargetChain}} parameter are matched. Specifies the chain to process when {{param|Target}} equals {{enum|TargetChain|Target}}. If there are no matching rules in the referenced chain, processing continues with the next rule in this chain (if any). In other words, {{enum|TargetChain|Target}} behaves like a subroutine call. {{empty}} indicates no {{param}} is specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). Enable or disable logging, in a {{object|###.DeviceInfo.VendorLogFile}}, of packets matching this {{object}}. If the {{object}} is not ''Static'' (as explained in the object description), whether changes to this parameter persist across re-boot is a local matter to the CPE. Date and time when this {{object}} entry was created. The time at which this {{object}} entry will expire, or {{null}} if not known. For an infinite lifetime, the parameter value MUST be 9999-12-31T23:59:59Z. The only value that MUST be supported is 9999-12-31T23:59:59Z (i.e. support for rules that expire is OPTIONAL). When a rule expires, the CPE MUST automatically terminate that rule and MUST automatically delete the corresponding {{object}} table entry. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. {{reference}} This specifies the ingress interface associated with the entry. It MAY be a layer 1, 2 or 3 interface, however, the types of interfaces for which Rules can be instantiated is a local matter to the CPE. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|SourceInterface}} entry, if specified. If {{true}}, the rule matches all packets except those that match the {{param|SourceInterface}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. This specifies that all ingress interfaces are associated with the entry. If {{true}}, the values of {{param|SourceInterface}} and {{param|SourceInterfaceExclude}} are ignored since all ingress interfaces are indicated. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. {{reference}} This specifies the egress interface associated with the entry. It MAY be a layer 1, 2 or 3 interface, however, the types of interfaces for which Rules can be instantiated is a local matter to the CPE. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|DestInterface}} entry, if specified. If {{true}}, the rule matches all packets except those that match the {{param|DestInterface}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. This specifies that all egress interfaces are associated with the entry. If {{true}}, the values of {{param|DestInterface}} and {{param|DestInterfaceExclude}} are ignored since all ingress interfaces are indicated. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. IP Protocol Version (e.g. 4 for IPv4 and 6 for IPv6). A value of -1 indicates this criterion is not used for matching. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. Destination IP address. {{empty}} indicates this criterion is not used for matching. Note that Firewall rules are applied after any {{object|###.NAT}} processing, so if NAT is enabled on the source interface this is always the translated address. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). Destination IP address mask, represented as an IP routing prefix using CIDR notation [RFC4632]. The IP address part MUST be {{empty}} (and, if specified, MUST be ignored). If {{false}}, the rule matches only those packets that match the (masked) {{param|DestIP}} entry, if specified. If {{true}}, the rule matches all packets except those that match the (masked) {{param|DestIP}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. Source IP address. {{empty}} indicates this criterion is not used for matching. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). Source IP address mask, represented as an IP routing prefix using CIDR notation [RFC4632]. The IP address part MUST be {{empty}} (and, if specified, MUST be ignored). If {{false}}, the rule matches only those packets that match the (masked) {{param|SourceIP}} entry, if specified. If {{true}}, the rule matches all packets except those that match the (masked) {{param|SourceIP}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. Protocol number. A value of -1 indicates this criterion is not used for matching. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|Protocol}} entry, if specified. If {{true}}, the rule matches all packets except those that match the {{param|Protocol}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. Destination port number. A value of -1 indicates this criterion is not used for matching. Note that Firewall rules are applied after any {{object|###.NAT}} processing, so if NAT is enabled on the source interface this is always the translated port number. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. If specified, indicates the {{object}} criterion is to include the port range from {{param|DestPort}} through {{param}} (inclusive). If specified, {{param}} MUST be greater than or equal to {{param|DestPort}}. A value of -1 indicates that no port range is specified. Note that Firewall rules are applied after any {{object|###.NAT}} processing, so if NAT is enabled on the source interface this is always the translated port number. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|DestPort}} entry (or port range), if specified. If {{true}}, the rule matches all packets except those that match the {{param|DestPort}} entry (or port range), if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. Source port number. A value of -1 indicates this criterion is not used for matching. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. If specified, indicates the {{object}} criterion is to include the port range from {{param|SourcePort}} through {{param}} (inclusive). If specified, {{param}} MUST be greater than or equal to {{param|SourcePort}}. A value of -1 indicates that no port range is specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|SourcePort}} entry (or port range), if specified. If {{true}}, the rule matches all packets except those that match the {{param|SourcePort}} entry (or port range), if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. DiffServ codepoint (defined in {{bibref|RFC2474}}). If set to a Class Selector Codepoint (defined in {{bibref|RFC2474}}), all DSCP values that match the first 3 bits will be considered a valid match. A value of -1 indicates this criterion is not used for matching. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|DSCP}} entry, if specified. If {{true}}, the rule matchess all packets except those that match the {{param|DSCP}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). REQUIRED only for devices that support NAT.