Session Handling
48
protocol="6"
comment="WAN access to company web server"/>
</rule-set>
Rule-set is named "firewall_to_LAN". The rule-set only applies to sessions targetting the "LAN"
interface, from any other interface. The action to perform when no rule within the rule-set applies, is to
"drop".
Rule is named "web", the criteria for matching the rule only specifies that the traffic must be targetting
TCP (protocol 6) port 80. The
action
attribute is not present, so the action defaults to "continue" -
processing continues with next rule-set. Unless any subsequent rule (in a later rule-set) drops the session,
the session will therefore be allowed.
If no rule matched the traffic, then the "no-match-action" of the rule-set is applied here - in this case the
session is dropped, thus enforcing a 'default drop' policy
Note
The FB6000 itself does not generally need firewalling rules to protect against unwanted or malicious
access, as the access controls on services can provide this protection directly - see Chapter 12 for
discussion of access controls.
.
You may want to perform some outbound traffic filtering as well. This would normally want to work the
other way around to inbound filtering. With inbound you want block all but those listed hence using a
no-
match-action
of
drop
. However, for outbound you will typically want a allow all but those listed. To this
end, you could create a rule-set for traffic from inside interfaces, such as
LAN
and a
no-match-action
of
continue
. Then include specific rules for those things you wish to block with an
action
of
reject
.
7.3.3.2. Changes to session traffic
Normally, a session table entry holds enough information to allow return traffic to reach its destination, without
potentially being firewalled.
However, a session-rule can specify certain changes to be made to the outbound traffic in a session, and the
session-table entry will hold additional information that allows the FB6000 to account for these changes when
processing the return traffic.
For example, a session-rule can specify that the source IP address of the outbound packets be changed, such
that they appear to be coming from a different address, typically one owned by the FB6000 itself. Return traffic
will then be sent back to this modified address - assuming that the intention is that this traffic reach the original
source IP address, the FB6000 will change the destination IP address in return traffic to be the original source
IP address. It can do this because it has stored the original source IP address in the session table entry.
The
set-source-ip
,
set-source-port
,
set-target-ip
and
set-target-port
attributes
request this kind of change to be made.
Note
Any rule that changes part of the "session" will affect the matching criteria in subsequent rule-sets and
rules - i.e. they test the changed version of the session.
Quite separately to firewalling and session tracking, the FB6000 has to route traffic, and this is done using
normal routing logic (see Chapter 8). The routing is done based on the destination IP address, as normal.
However, it can be useful for session tracking rules to override the normal routing. The
set-gateway
allows
a different IP address to be used for the routing decision, instead of the actual destination IP in the packets.
Setting this causes all subsequent packets matching the session to use that gateway IP for routing decisions.
Содержание FB6402
Страница 1: ...FireBrick FB6402 User Manual FB6000 Versatile Network Appliance...
Страница 2: ......
