Lantronix SCS Reference Manual page 203

Security
To permit NNTP traffic between the local and remote NNTP servers, the following commands are required:
Local>> DEF FILT fw_i ADD ALLOW IP TCP DPORT EQ NNTP SPORT GT 1023 DST 255.255.255.255 192.0.1.104 SRC
255.255.255.255 192.0.2.100
Local>> DEF FILT fw_i ADD ALLOW IP TCP SPORT EQ NNTP DPORT GT 1023 ACK DST 255.255.255.255 192.0.1.104
SRC 255.255.255.255 192.0.2.100
To permit outgoing FTP connections, the following commands are used:
Local>> DEF FILT fw_i ADD ALLOW IP TCP SPORT EQ FTP DPORT GT 1023 ACK
Local>> DEF FILT fw_i ADD ALLOW IP TCP SPORT EQ FTPDATA DPORT GT 1023
The following three commands deny incoming X-Windows traffic to well-known ports 6000-6023, but
permit incoming TCP/IP connections to ports greater than 1023. This configuration also allows PASV-
mode FTP data.
Local>> DEF FILT fw_i ADD ALLOW IP TCP SPORT GT 1023 DPORT GT 6024 ACK
Local>> DEF FILT fw_i ADD DENY IP TCP SPORT GT 1023 DPORT GE 6000 ACK
Local>> DEF FILT fw_i ADD ALLOW IP TCP SPORT GT 1023 DPORT GT 1023 ACK
The three commands below permit UDP- and TCP-based queries and answers to the local Domain Name
Server:
Local>> DEF FILT fw_i ADD ALLOW IP UDP DPORT EQ DNS DST 255.255.255.255 192.0.1.101
Local>> DEF FILT fw_i ADD ALLOW IP TCP DPORT EQ DNS SPORT GT 1023 DST 255.255.255.255 192.0.1.101
Local>> DEF FILT fw_i ADD ALLOW IP TCP SPORT EQ DNS DPORT GT 1023 ACK DST 255.255.255.255
192.0.1.101
To permit ICMP messages (except for redirect messages), a generic IP rule is defined:
Local>> DEF FILT fw_i ADD ALLOW IP ICMP IPGENERIC OFFSET 0 MASK 0xf0000000 NE 0x50000000
Outgoing finger requests are permitted and incoming requests are prevented using this command:
Local>> DEF FILT fw_i ADD ALLOW IP TCP SPORT EQ FINGER DPORT GT 1023 ACK
To use firewall fw_i as an incoming filter list for site irvine, the Define Site Filter Incoming command is
used:
Figure 11-63: Permitting Traffic Between NNTP Servers
Figure 11-64: Permitting Outgoing FTP Connections
Figure 11-65: Controlling X-Windows Traffic
Figure 11-66: Permitting DNS Queries
Figure 11-67: Permitting ICMP Messages
Figure 11-68: Permitting Outgoing Finger Requests
Figure 11-69: Configuring a Firewall
Local>> DEF SITE irvine FILTER INCOMING fw_i
11-32
Examples