Avocent MERGEPOINT 53XX SP MANAGER, Инструкция по установке и эксплуатации

Страница: 32 / 204

18
MergePoint Service Processor Manager SP53XX Installer/User Guide
Firewall/Packet Filtering
Packet filtering on the MergePoint SP manager is controlled by chains and rules that are configured
in iptables. By default, the MergePoint SP manager does not forward any traffic between private
and public networks. Rules can be added to allow limited communications between specific target
devices on the private network and the public network.
NOTE: It is possible for an Admin user to create rules that circumvent the access controls on a target device.
Chains
A chain is a type of named profile that defines rules for sorting packets.
The MergePoint SP manager has a number of built-in chains with hidden rules that are
preconfigured to control communications between target devices connected to the private Ethernet
ports and devices on the public side of the MergePoint SP manager.
The default chains are defined in filter and NAT (network address translation) iptables. The mangle
table is not used. The built-in chains are named according to the type of packets they handle. The
first three chains, INPUT, OUTPUT and FORWARD are in the iptables filter table.
PREROUTING, POSTROUTING and OUTPUT are in the NAT table and implement NAT. This
includes redirecting packets addressed to a virtual IP to the target device's real IP address and then
hiding the target device's real IP address when the target device sends packets to a user.
Rules
Each chain can have one or more rules that define the following:
• The packet characteristics being filtered. The packet is checked for characteristics defined in
the rule, for example, a specific IP header, input and output interfaces and protocol.
• What action is performed when the packet characteristics match the rule. The packet is handled
according to the specified action (called a Rule Target, Target Action or Policy).
Rules are listed in order of priority. You can change the rule order by clicking the arrow on the rule
line. The arrow appears when there are at least two rules in a list.
When a packet is filtered, its characteristics are compared against each rule in the list until a match
is found. Once a match is found, the packet is processed and no attempt is made to match lower
priority rules.
To add a new packet filtering (firewall) rule:
1. Click Network - Firewall.
2. Click Add for the chain to which you wish to add a rule.
3. Configure one or more of the following filtering options, as desired.
a. In the Protocol drop-down menu, select a protocol.