Access list, SOURCE NAT and DEST NAT
U
SER
G
UIDE
163
A
CCESS LIST
,
SOURCE
NAT
AND
DEST
NAT
There are basic modes and an advanced mode to handle the packet filtering tables on Imola.
The three basic modes are:
access-list
(Access Control List) applies filters for accepting or rejecting the IP packets in transit
source-nat
you can perform masking operations or change the source address of the IP packets
dest-nat
it allows to mask or to change the destination address of the IP packets
The advanced mode is:
iptables
it explicitly applies the packet filtering rules through the
iptables
command
It is important to consider the order according to which the rules are activated:
iptables
access-list
dest-nat
source-nat
The
iptables
command is described in detail in the following chapter.
A
CCESS
LIST
The list of rules for accepting or rejecting IP packets (known as Access List), and optionally make
the logging, can be activated with the command
set access-list
.
Generally, no access-list is defined on Imola so all the packets are accepted.
An access-list consists of a set of rules that allow to associate an action to a data stream, that is
identified by:
protocol type
source address or subnet
source port
recipient address or subnet
recipient port
The actions can be:
to accept the packets of the specified data stream
to accept and to log the packets
to block the packets
to block and to log the packets
The command that defines the access-list can assume the following variants:
set access-list LABEL NUM ACTION protocol PROTOCOL from ADDRESS to ADDRESS
set access-list LABEL NUM ACTION protocol PROTOCOL from ADDRESS source-port PORT to ADDRESS dest-port PORT
where:
