CERIO software core : cen_v3.0
Source Address/Mask :
Enter desired source IP address and netmask.
i.e. 192.168.2.10/32.
Source Port :
Enter a port or a range of ports as
start:end
.
i.e. port 20:80
Destination Address/Mask :
Enter desired destination IP address and netmask.
i.e.
192.168.1.10/32
Destination Port :
Enter a port or a range of ports as
start:end.
i.e. port 20:80
In/Out :
Applies to
Ingress or egress packets.
Protocol :
Supports
TCP
,
UDP
or
ICMP
.
Listen :
Click
Yes
radial button to match TCP packets only with the SYN flag.
Policy :
Deny
to drop and
Pass
to allow per filter rules
Interface :
The interface that a filter rule applies
Schedule :
Can choose to use rule by “Time Policy”
Click “
Save
” button to add IP filter rule. Total of
20
rules maximum allowed in the IP Filter
List. All rules can be edited or removed from the List. Click
Reboot
button to activate your
changes.
When you create rules in the IP Filter List, the prior rules maintain higher priority. To allow limited
access from a subnet to a destination network manager needs to create allow rules first and
followed by deny rules. So, if you just want one IP address to access the system via telnet from
your subnet, not others, the Example 1 demonstrates it, not rules in the Example 2.
Example 1
:
Create a higher priority rule to allow IP address 192.168.2.2 Telnet access from LAN port first, and
deny Telnet access from remaining IP addresses in the same subnet.
Rule
Source
Destination
In/Out
Protocol
Listen
Action
Side
IP/Mask
Port
IP/Mask
Port
1
192.168.2.2/32
192.168.2.254/32
22
In
TCP
n
Pass
LAN
2
192.168.2.0/24
192.168.2.254/32
22
In
TCP
n
Deny
LAN
Example 2 :
All Telnet access to the system from the IP addresses of subnet 192.168.2.x works with the rule 1
of Example 2. The rule 2 won’t make any difference.
Rule
Source
Destination
In/Out
Protocol
Listen
Action
Side
IP/Mask
Port
IP/Mask
Port
1
192.168.2.0/24
192.168.2.254/32
22
In
TCP
n
Pass
LAN
2
192.168.2.2/32
192.168.2.254/32
22
In
TCP
n
Deny
LAN
All packets are allowed by default. Deny rules could be added to the filter list to filter out
unwanted packets and leave remaining allowed.
