Alcatel AST570, User Manual

Page: 228 / 300

Example 2: Firewall
configuration with
NA(P)T
More information
17 Security Services - Firewalling
228 / 300
3EC 17766 AAAA TCZZA Ed. 04
Dynamic NA(P)T is applied for this DSL connection; all outgoing
Net10" IP addressed packets are translated into the
192.6.11.10 IP address. So the complete local (W)LAN is
presented towards the remote side as the single IP address
192.6.11.10.
In the following table, the rules to apply are summarized:
Flow Source Dest. Prot. Source
port
Dest.
port
ACK
=1
Action
Out 10.0.0.0/8 200.20.20.1 TCP 1024
65535
23 - accept
In 200.20.20.1 192.6.11.10 TCP 23 1024
65535
Yes accept
Any External Internal Any Any Any - drop
For the AST570 Firewall, this will result in the following CLI
configuration:
1. A chain must be created, e.g. 'Telnet':
firewall chain create chain=Telnet
2. Following rules must be created for that chain:
For the outgoing Telnet service packets:
firewall rule create chain=Telnet src=10.0.0.0/8
dst=200.20.20.1 srcintfgrp=lan prot=tcp
srcport=1024 srcportend=65535 dstport=23
action=accept
For incoming Telnet service reply packets:
firewall rule create chain=Telnet src=200.20.20.1
dst=192.6.11.10 srcintfgrp=wan prot=tcp srcport=23
dstport=1024 dstportend=65535 ack=yes
action=accept
For blocking all other services:
firewall rule create chain=Telnet action=drop
3. The chain 'Telnet' must be assigned to the input hook:
firewall assign hook=input chain=Telnet
See chapter 22 for more information on AST570 ' Firewall CLI
configuration.