10-6
Stinger®
IP2000 Configuration Guide
Filter Configuration
Defining IP filters
admin> set input-filters 2 valid-entry = yes
admin> set input-filters 2 Type = ip-filter
admin> set input-filters 2 forward = yes
admin> set input-filters 2 ip-filter protocol = 17
admin> set input-filters 2 ip-filter Src-Port-Cmp = gtr
admin> set input-filters 2 ip-filter source-port = 50
Explicit default filter rules
You can define your own explicit default rule to reverse this default filtering action.
An explicit default rule has following characteristics:
■
All filter fields of the default rule must be
0
(default values when the filter is
created).
■
The
valid-entry
field must be set to
yes
■
The
forward
entry for an IP filter must be set to the desired default action (
drop
or
forward
).
■
The
Type
of the filter must be either
generic-filter
or
ip-filter
.
Note
The IP2000 does not support generic packet filters, but you can specify a
generic explicit default rule in an IP filter. This is the only supported use of
generic-filter
for connections terminating on the IP2000. A generic default rule
affects all packet types that do not match the filter rules for a certain direction (input
or output). For details, see “Sample filter using a generic explicit default rule” on
page 10-7.
If a filter specifies more than one explicit default rule in the same direction, only the
first one is taken into account.
Sample filter with no explicit default rule
When you do not define an explicit default rule, the system uses the implicit default
which discards all packets that do not match the input and output filter rules. If a
filter defines rules only in one direction, traffic in the other direction is not filtered.
For example, the following sample filter specifies that UDP packets from a source port
less than 50 should be forwarded. Because it does not specify an explicit default rule,
this filter causes all packets that do not match input filter 1 to be dropped. Because
this filter does not define output rules, all packets are forwarded in the output
direction.
admin> new filter input-filter-1
admin> set input-filters 1 valid-entry = yes
admin> set input-filters 1 forward = yes
admin> set input-filters 1 Type = ip-filter
admin> set input-filters 1 ip-filter protocol = 17
admin> set input-filters 1 ip-filter source-address-mask = 255.255.255.255
admin> set input-filters 1 ip-filter source-address = 192.168.2.2
admin> set input-filters 1 ip-filter Src-Port-Cmp = less
admin> set input-filters 1 ip-filter source-port = 50
