Table of Contents
Advertisement
Example Filters
Rule to Permit DNS into Your Local Network
If the DNS name server for your domain is outside your local network, add the
following rule to your input filter:
Command> set filter Filtername RuleNumber permit udp src eq 53
This rule permits DNS replies into your local network.
Rule to Listen to RIP Information
To permit incoming RIP packets, add the following rule to your input filter:
Command> set filter Filtername RuleNumber permit 172.16.0.0/32 192.168.0.0/32
udp dst eq 520
In this example, 172.16.0.0/32 is the other end of the Internet connection and
192.168.0.0/32 is the local address of the connection.
Rule to Allow Authentication Queries
To allow authentication queries used by some mailers and FTP servers, add the
following rule to your input filter:
Command> set filter Filtername RuleNumber permit tcp dst eq 113
For more information about these types of queries, refer to RFC 1413.
Rule to Allow Networks Full Access
To allow some other network to have complete access to your network, add the
following rule. In the example below, 172.16.12.0 is granted full access to
192.168.1.0/24:
Command> set filter Filtername RuleNumber permit 172.16.12.0/24 192.168.1.0/24
Caution – Beware of associative trust. If you allow a network complete access to your
!
network, you might unknowingly allow other networks complete access, as well. Any
network that can access a network having complete access privileges to your network,
also has access to your network. For example, if Network 1 trusts Network 2 and
Network 2 trusts Network 3, then Network 1 trusts Network 3.
Restrictive Internet Filter
This example filter allows any kind of outgoing connection from the server, but blocks
all incoming traffic to any host but your designated Internet server. This filter also limits
incoming traffic on your Internet server to SMTP, Network News Transfer Protocol
(NNTP), DNS, FTP, and ICMP services.
8-10
PortMaster 4 Configuration Guide
Advertisement
Table of Contents
Troubleshooting
