Clavister SG4300 Series, Руководство по началу работы, Страница: 37 / 68

The destination network in the IP rule is specified as the predefined IP4 Address object all-nets.
This is used since we don't know to which IP address the web surfing will be done and this allows
surfing to any IP address. IP rules are processed in a top down fashion, with the first matching rule
being obeyed. An all-nets rule like this should be placed towards the bottom of the rule set since
other rules with narrower destination addreses should trigger before it does.
Only one rule is needed since any traffic controlled by a NAT rule will be controlled by the CorePlus
state engine. This means that the rule will allow connections that originate from the source
network/destination and also implicitly allow any returning traffic that results from those
connections.
In the above, we selected the service called http_all which is already defined in CorePlus. It is
advisable to make the service in an IP rule as restrictive as possible to provide the best security
possible. Custom service objects can be created and new service objects can be created which are
combinations of existing services.
We could have specified the rule Action to be Allow, but only if all the hosts on the protected local
network have public IP addresses. By using NAT, CorePlus will use the destination interface's IP
address as the source IP. This means that external hosts will send their responses back to the
interface IP and CorePlus will automatically direct the traffic back to the originating local host.
Only the outgoing interface therefore needs to have a public IP address and the internal network
topology is hidden.
To allow web surfing, DNS lookup also needs to be allowed in order to resolve URLs into IP
addresses. The service http_all does not include the DNS protocol so we need a similar IP rule that
allows this. This could be done with one IP rule that uses a custom service which combines the
HTTP and DNS protocols but the recommended method is to create an entirely new IP rule that
mirrors the above rule but specifies the service as dns-all. This method provides the most clarity
when the configuration is examined for any problems. The screenshot below shows a new rule
called lan_to_wan_dns being created to allow DNS.
3.3. Manual Web Interface Setup
Chapter 3. CorePlus Configuration
37