S R A / S F X 2 1 0 0 S E R I E S S A T E L L I T E R E C E I V E R
86
Firewall
The Firewall submenu is responsible for maintenance of the Firewall Tables in the receiver
and is really a more advanced filtering mechanism. There are two tables: one for the input
chain and one for the output chain, and up to 25 rules can be used to filter on various IP
packets, either by IP header or MAC address criteria in each table. Firewall tables are used
to filter on incoming IP data, regardless of the network interface the packet originated from.
Firewalling is done using options within the Linux
iptables
facility. More information on
iptables
can be obtained from the manual or tutorial online at sites such as
http://www.redhat.com
.
Additionally, you can contact IDC Customer Service for a copy of
the
iptables
tutorial (see Chapter 5). The
iptables
facility under Linux is extensive and
complex; and Firewalling is only one part of this facility. The Firewall submenu is intended
to make configuration of this function more user friendly.
Firewalling is performed by the receiver according to the following rules:
1. IP packets can originate from any of the available network interfaces and are
processed by the receiver in accordance with the data flow in Figure 4-9.
2. Up to 50 filtering rules can be entered in the editable table – 25 for INPUT and 25
for OUTPUT. Rules are executed from the first rule to the last rule, in sequence.
Order matters; the first rule that is applicable to the incoming packet is applied.
Subsequent rules after that are ignored.
3. If there is no applicable rule in the appropriate Firewall table, the corresponding
Input or Output default rule is applied to the packet.
4. Packets can be filtered by Source IP Address/Port or Destination IP Address/Port,
or both. Ports can only be specified if UDP or TCP protocols are selected.
5. Provision is made in the rule table for additional
iptables
options, allowing for
maximum flexibility. However, extreme care should be taken when using additional
options, and the
iptables
manual must be consulted in this case. (One example of
an option usage is for MAC Address Filtering, using options like:
“–m mac –mac-
source xx:xx:xx:xx:xx:xx
”.)
When the Firewalling submenu item is selected under Data Delivery, the Firewall Table
page is displayed for all applicable firewalling rules. A sample Firewall Table page is shown
in Figure 4-32.
