Digi TransPort WR11 User Manual page 773

Configuring security
oneroute
A rule will only match packets associated with the specified eroute. For example, including the option
oneroute 2 causes the rule to only match on packets transmitted or received over Eroute 2. The
oneroute option can be followed with the keyword any, which will match if the packet is on any
eroute.
Firewall rules specifying oneroute are only allowed with IPv4 rules. Using this keyword implies that
the rule should only match on IPv4 packets.
onvlan
Matches packets that have been received on the specified VLAN.
Firewall rules specifying onvlan are only allowed with IPv4 rules. Using this keyword implies that the
rule should only match on IPv4 packets.
onvrf
Matches packets that have been assigned to the specified VRF.
Firewall rules specifying onvrf are only allowed with IPv4 rules. Using this keyword implies that the
rule should only match on IPv4 packets.
routeto
When the routeto option is specified and the firewall is processing a received packet, if the rule is the
last matching rule, the packet is tagged as being required to be routed to the specified interface. For
example, the following filter rule ensures all packets from 10.1.*.* to 1.2.3.4 on the telnet port are all
routed to ETH 1:
pass i n br eak end r out et o et h 1 f r om 10. 1. 0. 0/ 16 t o 1. 2. 3. 4 por t =t el net
Firewall rules specifying routeto are only allowed with IPv4 rules. Using this keyword implies that the
rule should only match on IPv4 packets.
oosed
Checks the out of service status of an interface. For example, including the option oosed ppp 1 would
cause the rule to match only if interface PPP 1 is out of service.
Firewall rules specifying onvlan are only allowed with IPv4 rules. Using this keyword implies that the
rule should only match on IPv4 packets.
Digi TransPort® Routers User Guide
Firewall
773