44
MDS Orbit MCR-4G Technical Manual
MDS 05-6628A01, Rev. B
enabled <true|false>;
filter <name> {
rule <id> {
match {
protocol <icmp|udp|tcp|esp|all>;
src-address {
address <network/prefix> or address-range;
}
src-port {
services [ <name1> <name2> …] or port-range;
}
dst-address {
address <network/prefix> or address-range;
}
dst-port {
services [ <name1> <name2> …] or port-range;
}
ipsec {
direction <in|out>;
tunnel-src-address <network/prefix>;
tunnel-dst-address <network/prefix>;
}
}
actions {
action <accept|drop|reject>;
reject-type <net-unreachable|…>;
log {
level <debug|info|…>;
prefix <string>;
interfaces {
interface <name> {
filter {
input <name>;
output <name>;
Packet filter configuration on MCR involves following high level steps:
1. Create a filter, decide on default policy of the filter. For example, there are usually two ways to organize
a filter:
a.
Create a “restrictive” filter i.e. the last rule in the filter (also called “default policy” of
filter) is to deny traffic and rules are added to specifically permit the traffic. For example,
i. Rule 1 = permit protocol=tcp, dst port=22
ii.Rule 2 = permit protocol=icmp
iii.Rule 3 = deny everything
b. Or Create a “permissive” filter i.e. the last rule in the filter (also called “default policy” of
filter) is to permit traffic and rules are added to specifically deny traffic. For example,
i. Rule 1 = deny protocol=tcp, dst port=80
ii.Rule 2 = deny protocol=icmp
iii.Rule 3 = permit everything
2. Apply the filter to input or output direction of the interface.
