C613-50186-01 Rev B
Command Reference for AR2050V
2605
AlliedWare Plus™ Operating System - Version 5.4.7-1.x
F
IREWALL
C
OMMANDS
RULE
(F
IREWALL
)
Mode
Firewall Configuration
Usage
When the firewall is enabled and no rules are added, all traffic is blocked by default,
you can use this command to create rules for permitting packets between entities.
The rule is not valid and cannot be hit if either the application, source entity or
destination entity the rule applies to is not properly configured, for example, the
application does not exist or does not have a protocol configured or the entity
does not exist. To configure applications and entities, see Application and Entity
Commands. You can also use the
show firewall rule config-check
check rule configuration validity.
You can change the rule order by using the
Examples
To create a rule for permitting application ping between ‘public’ and ‘private’, use
the command:
awplus(config-firewall)#
rule 10 permit
ping from public to private
To create a rule for denying application http between ‘public.wan’ and
‘private.lan’, use the command:
awplus(config-firewall)#
rule 20 deny
http from public.wan to private.lan
To create a firewall rule to permit application ‘ping’ between ‘public’ and ‘dmz’
entities and to log the results, use the commands:
awplus(config-firewall)#
rule 30 permit
ping from public to dmz log
Related
commands
show firewall rule config-check
Command
changes
Version 5.4.7-0.1:
no-state-enforcement
option added.
no-state-enforcement
Optionally disable state enforcement for this
rule. Use this option with caution as it will
allow reverse path connection initiation. It
should be used only when the traffic forward
and reverse paths must be different and there
is no alternative approach available.
This option is disabled by default.
log
When ‘log’ is appended to a rule, the action is
applied and a log message is also generated
each time the rule is hit.
all
Delete all rules.
Parameter
Description