MDS 05-6628A01, Rev. B
MDS Orbit MCR-4G Technical Manual
43
Figure 19
shows the flow of packets being port-forwarded (DNAT’ed) through the MCR unit. For example,
TCP traffic arriving at the cellular interface and getting port forwarded to a private host connected to the
local Ethernet interface.
Invisible place holder
Figure 19. Packets Being Port-Forwarded Through MCR
Figure 20
shows the flow of packets being masqueraded (source NATed) through the MCR unit. For
example, TCP traffic from a private host arriving at Local Ethernet interface, being masqueraded to the cel-
lular interface’s IP address before being sent out the cellular interface.
Invisible place holder
Figure 20. Packets Being Masqueraded Through MCR
Packet Filtering
Understanding
Packet filtering allows configuring and applying a packet filter (also called Access Control List, or ACL) to
incoming or outgoing traffic on an interface. A filter is a set of one or more rules. Each rule consists of two
parts:
• Matching criteria that a packet must satisfy for the rule to be applied. Matching criteria consists of
various parameters like protocol, source/destination addresses and ports etc
• Actions that specify what to do with the packet when the matching criteria is met, for example, to
drop or accept the packet.
The filter can then be applied to an interface in the incoming or outgoing direction. Note that typically, dif-
ferent filters are applied in the incoming and outgoing direction on an interface. For example, a filter applied
to the cellular (WAN) interface of the MCR is typically very restrictive, permitting only a small set of traffic
to enter the MCR, where as outgoing filter might permit all outgoing traffic etc.
NOTE:
If the firewall service is enabled and no filter is applied to an interface, then both incoming and
outgoing traffic is dropped on that interface.
Configuring
Configuration Hierarchy
NOTE:
The configuration parameters shown here are a subset of all available configuration parameters.
Refer to the appendix for a complete listing.
firewall {
