Packet Filters - Multitech MultiAccess MA30120 User Manual

Packet Filters

Packet Filter Rules
The Packet Filter is a key element of the MultiAccess. Packet Filter Rules define the type of data traffic allowed
between networks and hosts. You can specify whether particular packets are to be passed through the system
or filtered. The rules are created with the help of the definitions you set up previously in the Networks &
Services section of this software.
See the ICMP menu (accessed from the left side of this screen) in which you can switch on the ICMP
forwarding between networks, as well as the ICMP (e.g., ping) reception for the MultiAccess itself.
To display rule violations and see an overview of the entire rule setup (packet filter, NAT), access the Filter
LiveLog.
Packet Filter Rules > Filter Rules
When you click the Filter Rules button, a screen of system rules displays.
Generally speaking "everything that is not explicitly allowed is forbidden".
The MultiAccess's behavior is determined by the content and order of the filter rules. The filter rules are
assigned by column number (column No). Every incoming data packet is checked, in order, as to whether
rule 1 is valid; rule 2 is valid, etc.) As soon as a correspondence is found, the procedure as determined by
the action is carried out. You can Accept, Drop, Reject, and Log the packets. When packets are denied
(Rejected setting) an entry in the appropriate log-file occurs.
All rules are entered according to the principle: From Client - Service - To Server - Action.
To be able to differentiate rules, the appropriate Networks & Services > Service Groups and Networks &
Services > Network Groups must first be defined.
When setting packet filters, the two fundamental types of security policies are:
•
All packets are allowed through – Rules Setup has to be informed explicitly what is forbidden.
•
All packets are blocked – Rules Setup needs information about which packets to let through.
Your MultiAccess default is that all packets are blocked setting, as this procedure can achieve an
inherently higher security. This means that you explicitly define which packets may pass through the filter.
All other packets are blocked and are displayed in the Filter LiveLog.
MultiAccess Communications Server MA30120 User Guide
> Add User Defined Filters
Packet Filters Rules > Add User Defined Filters
Chapter 3 – Software
71