HY-LINE truecon Router Handbuch Seite 24
HY-LINE Systems GmbH
Inselkammerstr. 10 82008 Unterhaching systems(at)hy-line.de www.hy-line.de/systems
F
F
i
i
r
r
e
e
w
w
a
a
l
l
l
l
.
.
c
c
o
o
n
n
f
f
:
:
A
A
d
d
v
v
a
a
n
n
c
c
e
e
d
d
e
e
d
d
i
i
t
t
i
i
n
n
g
g
,
,
u
u
s
s
e
e
o
o
f
f
o
o
w
w
n
n
r
r
i
i
s
s
k
k
!
!
N
N
A
A
T
T
-
-
C
C
o
o
n
n
f
f
i
i
g
g
u
u
r
r
a
a
t
t
i
i
o
o
n
n
/
/
S
S
h
h
e
e
l
l
l
l
:
:
- the configuration can be found in the folder: /etc/amsel/firewall.conf
- easy editing is doen with the WinSCP software (
http://winscp.net
)
- or login over serial or TCP/IP-SSH
- input the following commands: 1) sys sh 2) cd /etc/amsel 3) vi firewall.conf
Keyboard commands in editor: (i=insert, r=overwrite, esc, :=consol; x= save quit!=end without saving) dd
– delete line (not in insert mode) ctrl+L: New screen
Example configurations, please change the ports, protocol and IP addresses should be set to
your needs.
Data: /etc/amsel/firewall.conf
Add the following two lines to the input chain {
chain "input" {
accept proto "
tcp
" from iface $if_inet to port 5631;
accept proto "
udp
" from iface $if_inet to port 5632;
# wichtig bei Zugriff auf einen Geräte-Webserver (Port 80)
accept proto "
tcp
" from iface $if_inet to port 80;
accept proto "
udp
" from iface $if_inet to port 80;
};
chain "output" {
# services- wichtig bei Zugriff auf einen Geräte-Webserver (Port 80)
$http_out proto "tcp" from iface $if_ext to port 80;
$http_out proto "udp" from iface $if_ext to port 80;
};
Im Abschnitt "nat" in der "PREROUTING" chain folgende zwei Zeilen hinzufügen
PREROUTING {
dnat proto "
tcp
" from iface $if_inet to port 5631 with options { "--to-destination 192.168.1.50:5631" };
dnat proto "
udp
" from iface $if_inet to port 5632 with options { "--to-destination 192.168.1.50:5632" };
};
D
D
-
-
N
N
A
A
T
T
t
t
o
o
P
P
o
o
r
r
t
t
8
8
0
0
:
:
Esit the firewall.conf how described (insert hash sign)
chain "input" {
# protocols
$icmp_in proto "icmp" from iface $if_inet to any;
$dns_in proto "tcp" from iface $if_inet to port "domain";
$dns_in proto "udp" from iface $if_inet to port "domain";
# services
#
drop proto "tcp" from iface $if_inet to port "http";
