302565-A Rev. 00
Annex Communications Server R10.0B and Annex Host Tools R14.2 Release Notes
4
When a packet is sent by the Annex, the local output filter is scanned
first, followed by the global output filter list. When a packet is
received by the Annex, the local input filter list is scanned first,
followed by global input filter list. For the purposes of the algorithm,
local and global are combined into one large list, and input and output
are considered separately.
The algorithm scans each filter, and if the filter conditions match the
packet under consideration, the associated actions are appended to
one of two lists. If the filter is an include, the actions are placed on the
to-do
list. If the filter is an exclude, the actions are placed on the inhibit
list.
Once the complete list (both local and global) has been scanned, one
more check is done. If at least one include filter with the netact action
was seen (not necessarily matched, just scanned) and there were no
exclude filters with netact, the default action is none, that is, not netact.
If there were no include netact filters scanned or if any exclude netact
filters were seen, the default action is netact. This default is added to
the to-do list. Finally, the inhibit values are subtracted from the
to-do
list.
The following are examples of this process:
Example 1
No filters at all; all traffic is activity.
Example 2
in include proto tcp dst_port telnet netact
in include proto icmp discard
out include proto icmp discard
Packets received that are destined for the standard telnet port (23) are
considered activity and may trigger a dial if the interface is a dial-out
type. No other IP packets are considered activity, and icmp packets
(such as ping) going either way are discarded. (This shows how
include netact works by itself.)
