Cyclades AlterPath ACS, Command Reference Manual

Page: 137 / 420

AlterPath ACS Command Reference Guide
121
Network
4.9 Filters and Network Address Translation
The Filter feature is available for firmware versions 2.1.0 and above; the Network
Address Translation (NAT) feature is available for firmware versions 2.1.1 and above.
Description
IP filtering consists of blocking or not the passage of IP packets, based on rules which
describe the characteristics of the packet, such as the contents of the IP header, the
input/output interface, or the protocol. This feature is used mainly in firewall
applications, which filter the packets that could crack the network system or generate
unnecessary traffic in the network.
Network Address Translation (NAT) allows the IP packets to be translated from local
network to global network, and vice-versa. This feature is particularly useful when there
is demand for more IP addresses in the local network than available as global IP
addresses. In the ACS, this feature will be used mainly for clustering (one “Master”
Console server works as the interface between the global network and the “slave”
Console servers).
The ACS uses the Linux utility iptables to set up, maintain and inspect both the filter and
the NAT tables of IP packet rules in the Linux kernel. Besides filtering or translating
packets, the iptables utility is able to count the packets which match a rule, and to create
logs for specific rules.
Structure of the iptables
The iptables are structured in three levels: table, chain, and rule. A table can contain
several chains, and each chain can contain several rules.
Table
The table indicates how the iptables will work. There are currently three independent
tables supported by the iptables, but only two will be used:
•
filter: This is the default table.
•
nat: This table is consulted when a packet that creates a new connection is
encountered.
Chain
Each table contains a number of built-in chains and may also contain user-defined
chains. The built-in chains will be called according to the type of packet. User-defined
chains will be called when a rule which is matched by the packet points to the chain.
Each table has a particular set of built-in chains: