6
Firewall
97
IP rules and default main rule set
IP
rule
sets
are
the
most
important
of
the
SEG’s
security
policy
rule
sets.
They
determine
the
critical
packet
filtering
function
of
the
SEG,
regulating
what
is
allowed
or
not
allowed
to
pass
between
different
interfaces
and
between
interfaces
and
the
SEG.
By
default,
one
SEG
IP
rule
set
called
main
always
exists.
There
are
two
possible
approaches
to
how
traffic
traversing
the
SEG
could
be
dealt
with:
•
Everything
is
denied
unless
specifically
permitted.
•
Or
everything
is
permitted
unless
specifically
denied.
To
provide
optimal
security
from
the
outset,
the
SEG
uses
the
first
of
these
approaches.
This
means
that
when
started
for
the
first
time,
the
SEG
has
no
IP
rules
defined
in
the
main
IP
rule
set
and
all
traffic
arriving
at
all
interfaces
is
therefore
dropped.
To
permit
any
traffic
to
traverse
the
SEG
(as
well
as
allowing
the
SEG
to
respond
to
ICMP
Ping
requests),
some
initial
IP
rules
must
be
added
to
the
configuration.
Each
IP
rule
that
you
add
will
define
the
following
basic
filtering
criteria:
•
From
what
interface
to
what
interface
traffic
flows
(the
Source
Interface
and
Destination
Interface
).
•
From
what
network
to
what
network
the
traffic
flows
(the
Source
Network
and
Destination
Network
).
•
What
kind
of
protocol
is
affected
(the
Service
).
•
What
action
the
rule
will
take
when
a
match
on
all
the
criteria
is
triggered
(the
Action
).
Specifying any interface or network
When
specifying
the
filtering
criteria
in
any
of
the
rule
sets
specified
above
there
are
a
number
of
useful
predefined
filtering
parameters
that
can
be
used:
•
For
a
source
or
destination
network,
the
all
‐
nets
‐
ip4
address
object
is
equivalent
to
the
IPv4
address
0.0.0.0/0
,
which
will
mean
that
any
IPv4
address
is
acceptable.
Similarly,
the
all
‐
nets
‐
ip6
address
object
is
equivalent
to
any
IPv6
address.
The
address
object
all
‐
nets
includes
both
all
‐
nets
‐
ip4
and
all
‐
nets
‐
ip6
.
•
For
a
source
or
destination
interface,
the
any
option
can
be
used
so
that
the
SEG
will
not
care
about
the
interface
to
which
the
traffic
is
going
or
coming
from.
•
The
destination
interface
can
be
specified
as
core
.
This
means
that
traffic,
such
as
an
ICMP
Ping
,
is
destined
for
the
SEG
itself
and
the
SEG
will
respond
to
it.
New
flows
that
are
initiated
by
the
SEG
itself
do
not
need
an
explicit
IP
rule
as
they
are
allowed
by
default.
For
this
reason,
the
interface
core
is
not
used
as
the
source
interface.
•
The
service
can
be
specified
as
all_services
,
which
includes
all
possible
protocols.
