Compatible-systems 5.4 Manuel d'utilisateur télécharger pdf (Page 201)

Chapter 11 - TCP/IP Filtering 195

This rule would drop all packets with the source host address 192.15.1.10:

deny 192.15.1.10 0.0.0.0

A rule to drop all packets with a source network address of 192.15.1.0. All

packets from hosts on that network would be denied:

deny 192.15.1.0/24 0.0.0.0

IP Packet Filter Rule Set Examples

The rule set below allows only inbound and outbound mail from 192.15.14.1.

The input-filter:

permit 0.0.0.0 192.15.14.1 TCP src >= 1024 dst = 25

permit 0.0.0.0 192.15.14.1 TCP src = 25 dst >= 1024

The output-filter:

permit 192.15.14.1 0.0.0.0 TCP src = 25 dst >= 1024

permit 192.15.14.1 0.0.0.0 TCP src >= 1024 dst = 25

These sets of rules are intended to filter out all traffic and only allow

incoming and outgoing mail to a server inside a net with an IP address of

192.15.14.1. However they aren’t enough to prevent access from someone

outside using source port 25. This is because a connection to destination ports

greater than 1024 can be initiated according to the second rule in the input

filter. To prevent this from happening, add the est keyword to the second rule

in the input filter:

permit 0.0.0.0 192.15.14.1 TCP src = 25 dst >= 1024 est

The est keyword in this rule tells the device to only accept TCP packets on

the input to this interface when the connection has already been established.

A TCP packet which is attempting to initiate a connection will have only the

“SYN” flag set. If someone tries to establish a connection from the outside

using source port 25, the rule won’t match (no permit will occur). The

connection can’t be established since the packet will be dropped by the

default rule.

1 2 ... 196 197 198 199 200 201 202 203 204 205 206 ... 312 313

Pas de commentaire

Compatible-systems 5.4 Manuel d'utilisateur Page 201