}
9.2.1.1 The Operation Principle of Access Control
By default, as no access control rule exists on the Device, the Device will forward all
the valid packets received by the LAN interface. After you have enabled access
control, the Device will examine each packet received by the LAN interface to
determine whether to forward or drop the packet, based on the criteria you specified in
the access control rules.
When receiving a packet initiated from LAN, the Device will analyze the packet by
extracting its source MAC address, source IP address, destination IP address,
protocol type (TCP, UDP or ICMP), port number, content, and the date and time at
which the packet was received, and then compare them with each rule in the
Access
Control Rule List
in order, from top to bottom.
The first
rule
that matches the packet will be
applied to the packet, and the Device will forward or drop it according to this
rule
’s action. Note
that
after a match is found, no further rules will be checked; and if no match is found,
the Device will drop the packet to ensure security.
The access control rules are applied to the packets that are received by the Device
’s
LAN interface, that is, those packets that arrive on the LAN interface and then go
through the Device. If a packet matches a rule whose
Action
is
Allow
, the packet will
be allowed to pass, and then be further processed by route, NAT and other modules.
Else, if the packet matches a rule whose
Action
is
Drop
, or doesn
’t match any rule,
the packet will be dropped immediately. As these dropped packets are no longer
further processed by route, NAT and other modules, it will reduce CPU load and
improve the Device
performance.
The action of an access control rule is either
Allow
or
Deny
. When receiving a packet
that matches a rule in the
Access Control Rule
List
, the Device will forward the
packet if the rule
’s action is
Allow
; else the Device will drop it.
9.2.1.2 The Execution Order of Access Control Rules
The order of access control rules is very important. When receiving a packet initiated
from LAN, the Device will search Access Control Rule List to find out if there is a rule
that matches the packet. It will check the packet against each rule in the
Access
Control Rule List in order. After a match is found, no further rules will be checked. If no
match is found, the Device will drop the packet to ensure security. Note that by default
the rules are listed in reverse chronological order of creation, the later the rule is
created, the upper the rule is listed; and the Device allows you to manually move a
rule to a different position in the list.
Because the Device will allow or deny a packet to pass according to the first rule that
matches the packet, you should arrange the rules in Access Control Rule List from
specific to general. For example, if you create an access control rule at the beginning
that explicitly allows all packets to pass, no further rules are ever checked. Another
example is that if you only allow a LAN user to access Web service, and block any
other service, then the rule that allows the user to access Web service should be
listed above the rule that denies the user to access any other service.
