Tahoe 1800, User Manual

Page: 18 / 32

14
The “ifconfig” alone displays information about the active
interfaces. Entering “ifconfig <interface name>” shows information
about a certain interface. An information about interface’s IP address,
number of packets and bytes send and received, number of transmission
errors and other important data is displayed..
An IP address may be assigned to an interface, together with
subnet mask and broadcast address. A dynamic ARP may also be
enabled or disabled.
The “bridge” parameter allows to include or exclude certain
protocol from bridging, when the router works in the bridge mode.
3.3.12. ipchains
The command is used to control the firewall and the network
address translation (NAT, called also “masquerade” - that is giving a
network an access to the Internet using only one real IP address).
¡
ipchains add - adds an entry at the end of the list
¡
ipchains insert - adds an entry at the beginning of the list
¡
ipchains del - removes an entry
¡
ipchains list - displays current settings
¡
ipchains flush - removes all entries from the list
After the “add”, “insert” or “del” option following parameters
should be given:
¡
-s <source subnet>/<netmask> [port range]
Defines the source addresses which this entry concerns. If this
parameter is omitted, then the entry concerns all source addresses.
¡
-d <destination subnet>/<netmask> [port range]
Defines the destination addresses which this entry concerns. If
this parameter is omitted, then the entry concerns all destination
addresses.
¡
-p <protocol> (optional)
Optionally the application of this rule may be limited to a certain
protocol.
¡
-y (optional)
15
The rule may be applied to the TCP SYN packets only (i.e. the
packets that initiate the TCP connection). It allows inhibiting the
incoming connections while the returning packets for the outgoing ones
will be passed.
¡
-m <IP address>
By default during the masquerade an outgoing interface’s IP
address is used. The option above allows forcing use of another address.
¡
accept / deny / masq - information, what to do with a packet,
that conforms to a given rule (accept / discard / masquerade)
Note: The router always chooses the first matching rule from the
list. So if the more general rule comes first, and the more specific
is later, then the first one will be applied and the last one - ignored.
Thus the specific rule has to be inserted
before the general one,
as in following example:
ipchains add -s 215.16.11.0/24 deny
ipchains insert -s 215.16.11.5 accept
Commands above inhibit the access for the whole 215.16.11.0/24
subnet except the 215.16.11.5 address.
More examples:
ipchains add d 0.0.0.0/0 80-80 p tcp deny
Inhibits access to the port 80 on all external servers.
ipchains add s 192.168.0.0/16 masq
Enables masquerade for the 192.168.0.0/16 subnet (other
addresses are passed unchanged)
Note: The specific “accept” rule (concerning one IP address) has
to be inserted before the general one (concerning the whole
subnet), either using the “insert” command as in the example
above or by adding the specific rule first and then the general one.
Otherwise the router will always apply the first rule and will never
reach the second one, as the packet coming from 215.16.11.5 fits
both of them and if the general one is first, then it will be applied.