Lantronix LSB4, Справочное руководство, Страница: 33 / 74

LSB4 Reference Manual Filter Commands
6-3
Creating a “Firewall”
A firewall is one use of a filter list. Firewalls are often used to prevent all but one
type of traffic (for example, traffic from a specific node) from reaching a partic-
ular network segment. When traffic destined for a specific segment reaches the
LSB4, it will be compared to a filter list; if it is any but a specified type of traffic,
it hits a ÒfirewallÓ and goes no further--the packet is discarded.
The commands listed below [Figure 6-3] create a firewall between LAN 1 and
any other network segment. Filter 1 is configured to deny access to IP packets;
this filter is assigned to port 1, preventing IP packets from traveling from port 1
to other segments.
Figure 6-3: Preventing IP Traffic Out of Port 1
Figure 6-3 included a
Set Privileged
command before the Set Filter command.
The Set Filter command requires privileged status; if privileged status is current-
ly enabled, the Set Privileged command will not be necessary.
The commands in Figure 6-4 prevent any IP traffic between LSB4 ports; for ex-
ample, IP packets from LAN 1 cannot reach LAN 2, and IP packets from LAN 2
cannot reach LAN 4.
Figure 6-4: Preventing IP Traffic Between All Segments
The Set Switch command used above did not specify a particular ethernet port
to be used with filter 1, as a result, all LSB4 ports will deny IP traffic.
Figure 6-5 gives an example of a firewall that enables two nodes to send packets
to each other through the LSB4; traffic from any other node will not be permitted
passage between the two nodes.
Figure 6-5: Isolating Two Nodes With a Firewall
Local_1> SET PRIVILEGED
Local_1> SYSTEM (not echoed)
Local_1>> SET FILTER 1 APPEND PROTOCOL IP DENY
Local_1>> SET SWITCH ETHERNET 1 FILTER 1
Local> SET PRIVILEGED
Password> SYSTEM (not echoed)
Local_1>> SET FILTER 1 APPEND PROTOCOL IP DENY
Local_1>> SET SWITCH FILTER 1
Local_1> SET PRIVILEGED
Local_1>> SYSTEM (not echoed)
Local_1>> SET FILTER 1 APPEND SOURCE 0:80:a3:01:02:03
Local_1>> SET FILTER 1 APPEND SOURCE 0:80:a3:03:02:01
Local_1>> SET FILTER 1 APPEND ALL DENY