Rules - RuggedCom RuggedRouter RX1000 User Manual

RuggedRouter® User Guide
3) This example is much the same as the previous one only the subnet is explicitly
described, and could include traffic from any of the Ethernet ports.
4) In this SNAT rule, traffic from the subnet handled by only port eth1 should be
translated to 100.1.101.16 as it sent to the Internet on t1/e1 port w1ppp.
5) This example is much the same as the previous one excepting that only smtp from
eth1 will be allowed.
Masquerading and SNAT rules are defined in the file /etc/shorewall/masq and are
modified from the Masquerading menu.

Rules

The default policies can completely configure traffic based upon zones. But the
default policies cannot take into account criteria such as the type of protocol, IP
source/destination addresses and the need to perform special actions such as port
forwarding. The Shorewall rules can accomplish this.
The Shorewall rules provide exceptions to the default policies. In actuality, when a
connection request arrives the rules file is inspected first. If no match is found then
the default policy is applied. Rules are of the form:
Action
Port Original-Destination-IP Rate-Limit User-Group
Actions are ACCEPT, DROP, REJECT, DNAT, DNAT-, REDIRECT, REDIRECT-,
CONTINUE, LOG and QUEUE. The DNAT-, REDIRECT-, CONTINUE, LOG and
QUEUE actions are not widely used used and are not described here.
Action
ACCEPT
DROP
REJECT
DNAT
REDIRECT Redirect the request to a local tcp port number on the local firewall.
The remaining fields of a rule are as described below:
Action
Source-Zone
Destination-Zone
Protocol
Destination-Port
Source-Port
Original-
Destination-IP
116
Source-Zone Destination-Zone Protocol Destination-Port Source-
Description
Allow the connection request to proceed.
The connection request is simply ignored. No notification is made to
the requesting client.
The connection request is rejected with an RST (TCP) or an ICMP
destination-unreachable packet being returned to the client.
Forward the request to another system (and optionally another port).
This is most often used to "remap" port numbers for services on the
firewall itself.
The action as described in the previous table.
The zone the connection originated from.
The zone the connection is destined for.
The tcp or udp protocol type.
The tcp/udp port the connection is destined for.
The tcp/udp port the connection originated from.
The destination IP address in the connection request as it was
received by the firewall.
RuggedCom