314
Protocol
Select one of the protocols from the list. Each protocol represents a set of IP
protocol and port definitions. You will find the details in menu "Definitions >
Protocols". This is also where you can extend the list with your own protocol
definitions.
Policy
Access may either be allowed or forbidden. When denying a connection, SX-
GATE can either silently discard the IP packet or reject it with an "administratively
prohibited" ICMP reply message. The latter indicates the reason for the
connection failure to the sender.
Dest. (
…
)
If you leave these fields blank, the rule will apply to any destination IP. To grant
access to a single server only, please enter its IP address. To give access to a
whole network, specify the network address and its corresponding netmask (e.g.
192.168.0.0/24). To configure a rule for multiple individual clients or networks,
define a new group in menu "Definitions > IP objects" or select an entry from the
list of available groups.
DoS
If you like you can also activate the Denial-of-Service protection by the dynamic
firewall. For TCP the value refers to the maximum number of connections per
source IP. For all other protocols you specify the number of packets per source IP.
Comment
Use this field for documentation. Up to 14 characters from this field will be included
in the log if logging is enabled for this rule.
14.2.2-G
* > SNAT
On this tab you define Network-Address-Translation rules (NAT, SNAT). SNAT
modifies the source IP of a connection. This is necessary when IP packets with an
internal source IP have to be forwarded to the Internet. SNAT can also be used to set
a specific sender address for certain services if multiple Internet IPs are assigned to
SX-GATE.
In most cases it is not necessary to configure anything here.
The default behaviour is "automatic SNAT", i.e. NAT will apply
only on interfaces classified as "Internet", and only to IPv4
connections originating in the LAN or RAS zone. As an exception
there's no automatic SNAT on DS-Lite links.
