3Com REMOTE ACCESS SYSTEM 1500, Руководство по управлению

Страница: 237 / 300

Filter Examples
235
The following rule example allows forwarding of IP packets with source
address 192.077.100.032 and destination address 201.128.011.034:
#filter
IP:
010 AND src-addr = 192.077.100.032;
020 ACCEPT dst-addr = 201.128.011.034;
The following rule example limits a user to one host with an input filter:
#filter
IP:010 ACCEPT dst-addr = 143.134.45.56;
020 DENY;
Masks
These fields specify the number of bits to be used in the source address
and destination address comparisons. The following are valid values:
■
0
— Match all packets with any IP address. The contents of
source
address
or
destination address
fields are unimportant.
■
8
— Compare the first byte (octet) in the IP addresses.
■
16
— Compare only the first two bytes of the IP addresses.
■
24
— Compare only the first three bytes of the IP Addresses.
■
32
— Match the entire IP address (default).
The masks are separated from
source address
and
destination
address
by forward slashes (/).
TCP and UDP Parameter Filtering
TCP and UDP packets are typically sent from and destined for standard
port numbers that provide common network services, such as Domain
Name Service, SNMP, and Telnet. You can filter TCP and UDP packets by
source and destination ports by defining filter rules that compare the port
number in a TCP or UDP packet to a specific value.
The following rule example accepts only TCP packets that have a source
port number of 24 or greater.
#filter
IP:
010 ACCEPT tcp-src-port >= 24;
020 DENY;