BinTec X4000, Руководство пользователя

Страница: 335 / 498

X4000 User’s Guide 335
Access Security
10
➤
Repeat these steps to define several entries for the selected NAT interface.
10.2.8 Filters (Access Lists)
IP filters (
➤➤
Access Lists ) in X4000 are based on a concept of
➤➤
filters ,
rules and so-called chains. IP filters respond to incoming data packets, which
means they can allow or deny access to X4000 for certain data.
Filters A filter describes a certain part of the IP data traffic based on the source and/or
destination IP address,
➤➤
netmask , protocol and source and/or destination
port. If you define a filter, you are telling X4000 : "Watch out for all data packets
that match the following: ...".
Rule You use a rule to tell X4000 what to do with the data packets it has filtered out,
i.e. whether or not it should allow them to pass through. You can also define
several rules, which you arrange in the form of a chain to obtain a certain
sequence.
Chain There are various approaches for the definition of rules and rule chains:
■
Allow all packets that are not explicitly prohibited, i.e.:
– Deny all packets that match Filter 1.
– Deny all packets that match Filter 2.
– ...
– ...
– Allow the rest.
■
Allow only what is explicitly permitted, i.e.:
– Allow all packets that match Filter 1.
– Allow all packets that match Filter 2.
– ...
– ...
– Deny the rest.
■
Combination of the two possibilities described above
Several rule chains can be created, either completely or partly separated
from each other. The common use of filters is possible and practicable.
Interface You can also define a rule chain individually for each X4000 interface.