Rules - RuggedCom RuggedBackbone RX1500 User Manual

38. Firewall

38.3.6. Rules

The default policies can completely configure traffic based upon zones. But the default policies cannot
take into account criteria such as the type of protocol, IP source/destination addresses and the need to
perform special actions such as port forwarding. The firewall rules can accomplish this.
The ROX™ firewall rules provide exceptions to the default policies. In actuality, when a connection
request arrives, the rules file is inspected first. If no match is found then the default policy is applied.
Rules are of the form:
Action Source-Zone Destination-Zone Protocol Destination-Port Source-Port Original-Destination-IP
Rate-Limit User-Group
Actions are ACCEPT, DROP, REJECT, DNAT, DNAT-, REDIRECT, REDIRECT-, CONTINUE, LOG
and QUEUE. The DNAT-, REDIRECT-, CONTINUE, LOG and QUEUE actions are not widely used
used and are not described here.
Action Description
ACCEPT Allow the connection request to proceed.
DROP The connection request is simply ignored. No notification is made to the requesting client.
REJECT The connection request is rejected with an RST (TCP) or an ICMP destination-unreachable packet being
returned to the client.
DNAT Forward the request to another system (and optionally another port).
REDIRECT Redirect the request to a local tcp port number on the local firewall. This is most often used to "remap"
port numbers for services on the firewall itself.
Table 38.7.
The remaining fields of a rule are as described below:
Rule Field
Action
Source-Zone
Destination-Zone
Protocol
Destination-Port
Source-Port
Original-Destination-IP
Rate-Limit
Table 38.8.
Some examples will illustrate the power of the rules file:
Rule Action Source-Zone
1 ACCEPT net:204.18.45.0/24
2 DNAT net
3 DNAT net:204.18.45.0/24
4 ACCEPT fw
5 ACCEPT net:204.18.45.0/24
Table 38.9.
1. This rule accepts traffic to the firewall itself from the 204.18.45.0/24 subnet. If the default policy is to
drop all requests from net to the firewall, this rule will only accept traffic from the authorized subnet.
2. This rule forwards all ssh and http connection requests from the Internet to local system 192.168.1.3.
ROX™ v2.2 User Guide
Description
The action as described in the previous table.
The zone the connection originated from.
The zone the connection is destined for.
The tcp or udp protocol type.
The tcp/udp port the connection is destined for.
The tcp/udp port the connection originated from.
The destination IP address in the connection request as it was received by the firewall.
A specification which allows the rate at which connections are made to be limited.
Destination-Zone
fw
loc:192.168.1.3
loc:192.168.1.3
net
fw
442
Protocol Dest-Port Source-
Port
tcp ssh, http
tcp http -
icmp
icmp 8
RuggedBackbone™ RX1500
Original-Destination-IP
130.252.100.69