ETHERLINE
®
ACCESS NF04T | Version 1 | 04/16/20
31
In the bridge mode, all ports are initially blocked for “WAN-to-LAN” data transfer for security reasons!
In order to enable access, packet filter rules must be created
or the default action for the packet filters be set to “Accept”.
See the following chapter.
The “LAN to WAN” data transfer is initially always released but can also be
limited by packet filters or the default action.
7.3
Packet filter “WAN to LAN”
The packet filters enable the limitation of access between the
production network (WAN) and the machine network (LAN).
For example, it can be configured that only certain participants from the
production network may exchange data with defined participants from
the automation cell.
The following filter criteria on layers 3 and 4 are available: IPv4 addresses, protocol (TCP/UDP), and ports.
Note: The packet filters are always also available in the direction “LAN to WAN”, see chapter XX.
Select the “WAN to LAN” menu point in the “Packet Filter” menu.
With the “Default Option” you can set whether all frames are generally allowed (“Accept”) and only special packets
are filtered (“Blacklisting”), or whether all frames are generally prohibited (“Reject” / “Drop”) and only those frames
are allowed to pass through that correspond with the filter rules (“Whitelisting”).
If you initially don’t wish to filter, set the default action to “Accept”.
In order to limit access to the machine network to certain participants in the WAN, set the default action to “Reject”
or “Drop”. In the case of prohibited frames from the WAN, “Reject”
sends an error message in response, while “Drop” rejects the frame
without sending an error message.
