Eicon Networks S52 Guide de l'utilisateur télécharger pdf (Page 39)

Eicon Connections for Linux User’s Guide

page 37

Configuring Packet Filtering Rules

When Routing Services receives an IP datagram over an interface, it checks the configured

packet filtering rules, and transparently forwards or drops the datagram based on these rules.

It is important to note that adding packet filtering will affect the performance of Eiconcard

Routing Services. As each IP datagram has to be tested against all of the defined packet

filtering rules, the datagrams will be delayed. It is therefore recommended to keep the number

of defined rules to a minimum and to make the rules as simple as possible.

Note: If no packet filtering rules are defined, all packets are forwarded by default.

Creating Packet Filtering Rules

Packet filtering allows you to determine what type of IP traffic can pass through your WAN

connections. You can control access to and from specific services, hosts, or networks. The

syntax for configuring packet filtering rules is given below with a detailed explanation of the

available options:

Syntax filter [-saddr source_addr addr_mask]

[-daddr dest_addr addr_mask][-prot IP_protocol]

[-sport [source_port]][-dport [dest_port]]

in|out|both drop|forward

Parameters Description

-saddr

source_addr

addr_mask

Specifies the source address and address mask for which you are

specifying a packet filtering rule. All packets with a source address

that match an address specified in the packet filtering rules will be

either forwarded or dropped.

-daddr

dest_addr

addr_mask

Specifies the destination address and address mask for which you

are specifying a packet filtering rule. All packets with a destination

address that match an address specified in the packet filtering rules

will be either forwarded or dropped.

-prot

IP_protocol

Identifies the Transport Layer Protocol for which a packet filtering

rule is being specified. The protocol field of the IP datagram specifies

the Transport Layer Protocol encapsulated in the IP datagram. All

packets with a Transport Layer Protocol that match a protocol

specified in the packet filtering rules will be either forwarded or

dropped. TCP and UDP are currently the only Transport Layer

Protocols that support source and destination port checks (see

/etc/protocols).

-sport

[source_port]

Specifies the source port for which you are specifying a packet

filtering rule. All TCP/IP protocols use addresses, known as ports,

that are used to uniquely define services (access points to the

Transport layer) at the Transport layer (see /etc/services). For

example, all ftp connections to a host are directed to port number

21; this way the receiving host knows to send the request to the ftp

service and not to the telnet service. All packets with a source port

that match a port specified in the packet filtering rules are either

forwarded or dropped. A source port is specified to prevent access

to certain services or applications on a local system by remote hosts.

This option must be enclosed within the brackets and port ranges

must be specified numerically.

1 2 ... 34 35 36 37 38 39 40 41 42 43 44 ... 90 91

Commentaires sur ces manuels

Pas de commentaire

Eicon Networks S52 Guide de l'utilisateur Page 39

Commentaires sur ces manuels

Produits connexes et manuels pour Mise en réseau Eicon Networks S52