Bay Networks 5390, Administering, Page: 351 / 888

893-741-B A13-13
Filtering
add Subcommand Examples
Because the NFS and TFTP protocols do not support password protection, you may want to use
filtering to prevent hosts on an external network from using those protocols to access files on your
internal network. To do this, select the Model 5390 server to act as a firewall between the local and
external network and create filters on it to block NFS and TFTP traffic. For example, you could
create the following two filters, which prevent TFTP or NFS packets from crossing Model 5390
interface asy8:
annex# filter
filter: add asy8 input include protocol udp port_pair\
>
nfs * icmp
filter: add asy8 input include protocol udp port_pair\
>
tftp * icmp
Note the following about the preceding sample filters:
• Both filters apply only to packets arriving on Model 5390 interface asy8 (which could attach
to either a PPP or SLIP line). To apply a filter to an another interface, specify a second filter
for that interface, or specify * instead of asy8, thereby blocking the protocol on all interfaces.
• Both filters match packets whose network protocol family is IP. Since the family argument is
optional (IP is assumed), the examples omit it.
• Both filters specify protocol as UDP because UDP is the transport-level protocol on which
NFS and TFTP operate.
• The port_pair argument in each filter specifies that the filter applies to any UDP packet that
contains NFS or TFTP in its source or destination protocol field.
• When one of these filters matches a packet, the Model 5390 server discards the packet and
sends the ICMP destination unreachable, communication administratively prohibited message
to the originator of packet. To discard the packet without sending a message, specify discard
instead of icmp.