ETIC RAS-E, User Manual, Page: 113 / 132

ADVANCED SET-UP
Machine Access Box RAS
DOC_DEV_RAS_User guide_A
Page 113
14.2 Main filter
The main filter applies to all the IP packets except to the ones included in remote users connections.
To recognize a TLS remote user connection, the router detects the port number.
14.2.1 Main filter prganisation
 Main filter structure
For a better organisation, the main filter is divided in two tables; both having the same structure.
The “VPN” filter : It filter the packets transmitted inside the VPNs.
The “WAN” filter : It filters the packets transmitted outside the VPNs
Each of that two filters is made of
a filter policy
and
a filter table each line of which is a filter rule
 Main filter default policy
The default policy is the decision which will be applied if a packet does not match any of the rules of the filter.
The WAN to LAN and the LAN to WAN traffic are regarded separately because the decision can be opposite
for a packet coming from the WAN or coming from the LAN :
WAN to LAN : The default policy can be “Accept” or “drop”.
LAN to WAN : The default policy can also be “Accept” or “drop”.
For instance, if the default policy assigned the WAN to LAN traffic is “drop”, it means that an IP packet which
does not match any of the rules of the main filter will be rejected.

Main filter table
The main filter is a table, each line being a rule.
Each rule of the filter is composed a several fields which defines a particular data flow and another field
which is called the action field.
The fields which define the data flow are :
Direction (« WAN to LAN » or « LAN to WAN »),
Protocol (TCP, UDP…),
IP@ & port number, source & destination.
The Action field can take two values
Accept : To authorize the data flow to be forwarded to the router interface.
Drop : To drop the packet which matches the rule.
 How does the main filters works
When the firewall receives a packet, it checks if it matches the first rule..
If it does, the decision is applied to the packet according to the “Action” field.
If it does not, the firewall checks if it matches the second rule; and so on.