IP Filtering
7-2
8000-A2-GB21-20
November 1997
NOTE:
If your system is set up for dynamic IP addressing and you have enabled the
dynamic access control feature, you do not need to configure filters because
this is done automatically. However, you will need to bind the filters to the
appropriate interface. The dynamic access control feature is configurable on
the DHCP Relay Servers screen. See Chapter 6 of the
HotWire DSLAM for
8540 and 8546 DSL Cards User’s Guide for more information.
You can create the following filter types:
An input filter to prevent packets entering the DSL card through a specified
interface from being forwarded. You may want to set up filtering on input to
protect against address spoofing. Use the IP Network screen
(
Configuration
→
Interfaces
→
IP Network) to specify binding of an input filter
to a particular interface.
An output filter to prevent packets from going out of the DSL card through a
specified interface. Use the IP Network screen (
Configuration
→
Interfaces
→
IP Network) to specify binding of an output filter to a particular interface.
For each filter type, you must set up one or more of the following rule types on
the IP Filter Configuration screen (
Configuration
→
IP Router
→
IP Router Filters):
A network address rule type to discard or forward packets/traffic from a
specified network or a segment of the network. This rule type can also be
used to enhance security by allowing access only to certain networks. The IP
address and subnet mask specified in the
Destination address
and
Destination address mask
fields, or the
Source address
and
Source address mask
fields of the IP Filter Configuration screen are
compared to the destination/source address contained in the IP header of the
packet.
A host address rule type to discard or forward packets/traffic from a
specified host. This rule type can also be used to enhance security by
allowing access only to certain hosts. The IP address and subnet mask
specified in the
Destination address
and
Destination address
mask
fields, or the
Source address
and
Source address mask
fields of
the IP Filter Configuration screen are compared to the destination/source
address contained in the IP header of the packet.
NOTE:
Host address rules have precedence over network address rules. All host
address rules will be invoked sequentially before the first network
address rule is invoked.
A socket address rule type to limit certain applications. This rule type is
used primarily when filtering TCP or UDP packets, and may be used in
conjunction with a network address rule type or a host address rule type. The
destination (socket) port number specified in the
Destination Port No.
field and source (socket) port number specified in the
Source Port No.
field of the IP Filter Configuration screen are compared to the destination and
source port numbers in the TCP or UDP header of the packet.
