Firewall
Administrators can configure the console server to act as a firewall. By default, three built-in chains accept all INPUT,
FORWARD and OUTPUT packets. Select the
Add
,
Delete
or
Change Policy
buttons to add a user chain, delete user-added
chains and to change the built-in chains policy. Default chains can have their policy changed (Change Policy) to accept or
drop, but cannot be deleted. Clicking on the
Chain Name
allows you to configure rules for chains.
Firewall configuration is available by clicking on
Network - Firewall
. Separate but identical configuration screens are
available from either the
IPv4 Filter Table
or
IPv6 Filter Table
menu options.
Only the policy can be edited for a default chain; default chain policy options are ACCEPT and DROP.
When a chain is added, only a named entry for the chain is created. One or more rules must be configured for a chain after it
is added.
Configuring the firewall
For each rule, an action (either
ACCEPT
,
DROP
,
LOG, REJECT or RETURN
) must be selected from the Target pull-down
menu. The selected action is performed on an IP packet that matches all the criteria specified in the rule.
If
LOG
is selected from the Target pull-down menu, the administrator can configure a Log Level and a Log Prefix.
If
REJECT
is selected from the Target pull-down menu, the administrator can select an option from the Reject with pull-
down menu; the packet is dropped and a reply packet of the selected type is sent.
Protocol options
Different fields are activated for each option in the Protocol pull-down menu.
If
Numeric
is selected from the Protocol menu, enter a Protocol Number in the text field.
If
TCP
is selected from the Protocol menu, a TCP Options Section is activated for entering source and destination ports and
TCP flags.
If
UDP
is selected from the Protocol menu, the UDP section is activated for entering source and destination ports.
FIELD/MENU OPTION
DEFINITION
Source Port - or -
Destination Port
A single IP address or a range of IP addresses.
TCP Flags
[TCP only] SYN (synchronize), ACK (acknowledge), FIN (finish), RST (reset), URG (urgent) and PSH (push). The conditions in the
pull-down menu for each flag are: Any, Set or Unset.
Table 3.3 Firewall Configuration - TCP and UDP Options Fields
If ICMP is selected from the Protocol menu, the ICMP Type pull-down menu is activated.
If an administrator enters the Ethernet interface (eth0 or eth1) in the input or output interface fields and selects an option
(
2nd and further packets
,
All packets and fragments
or
Unfragmented packets and 1st packets
) from the Fragments pull-
down menu, the target action is performed on packets from or to the specified interface if they meet the criteria in the
selected Fragments menu option.
To add a chain:
1.
Select
Network - Firewall
.
2.
Select either
IPv4 Filter Table
or
IPv6 Filter Table
as needed.
3.
Click
Add
.
3 Accessing the Console System via the Web UI
25
