Field
Description
In addition, the service groups configured in
Firewall->Services->Groups can be selected.
Action
Select the action to be applied to a filtered packet.
Possible values:
•
,**
(default value): The packets are forwarded on the
basis of the entries.
•
-0
: The packets are rejected.
•
?O*
: The packets are rejected. An error message is is-
sued to the sender of the packet.
15.1.2 IPv6 Filter Rules
The default behaviour with Action =
,**
consists of two implicit filter rules: If an in-
coming packet can be assigned to an existing connection and if a suitable connection is ex-
pected (e.g. such as an affiliated connection of an existing connection), the packet is al-
lowed.
The sequence of filter rules in the list is relevant: The filter rules are applied to each packet
in succession until a rule matches. If overlapping occurs, i.e. more than one filter rule
matches a packet, only the first rule is executed. This means that if the first rule denies a
packet, whereas a later rule allows it, the packet is rejected. A deny rule also has no effect
if a relevant packet has previously been allowed by another filter rule.
The security concept is based on the assumption that an infrastructure consists of trusted
and untrusted zones. The security policies
)3
and
/3
describe this as-
sumption. They define the filter rules Trusted Interfaces and Untrusted Interfaces which
are created by default and cannot be deleted.
If you use the Security Policy
)3
, all data packets are accepted. You can create
additional filter rules that discard specific packets. In the same way, you can allow specific
packets when using the
/3
policy.
A list of all configured filter rules is displayed in the Firewall->Policies->IPv6 Filter Rules
menu.
Using the
button in the line Trusted Interfaces , you can determine which interfaces are
Trusted . A new window opens with an interface list. You can mark individual interfaces as
trusted.
bintec elmeg GmbH
15 Firewall
be.IP 4isdn
281
