BinTec X3200, Руководство пользователя

Страница: 286 / 419

286 BinTec Communications AG
Security Mechanisms
7
Proceed as follows to allow certain connections for a NAT interface to a certain
host in the LAN:
➤
Go to IP
➧
N
ETWORK
A
DDRESS
T
RANSLATION
➧
E
DIT
.
➤
Add an entry with ADD or select an existing entry and confirm with Return.
➤
Select Service.
➤
Select Protocol, if applicable.
➤
Enter Port (-1 for any), if applicable.
➤
Enter Destination.
➤
Press SAVE.
➤
Repeat these steps to define several entries for the selected NAT interface.
7.2.8 Filters (Access Lists)
IP filters (
➤➤
Access Lists ) in X3200 are based on a concept of
➤➤
filters ,
rules and so-called chains. IP filters respond to incoming data packets, which
means they can allow or deny access to X3200 for certain data.
Filters A filter describes a certain part of the IP data traffic based on the source and/or
destination IP address,
➤➤
netmask , protocol and source and/or destination
port. If you define a filter, you are telling X3200 : "Watch out for all data packets
that match the following: ...".
Rule You use a rule to tell X3200 what to do with the data packets it has filtered out,
i.e. whether or not it should allow them to pass through. You can also define
several rules, which you arrange in the form of a chain to obtain a certain se-
quence.
Chain There are various approaches for the definition of rules and rule chains:
■
Allow all packets that are not explicitly prohibited, i.e.:
– Deny all packets that match Filter 1.
– Deny all packets that match Filter 2.
– ...
– ...
– Allow the rest.