RuggedCom RUGGEDBACKBONE RX5000, Руководство пользователя

Страница: 373 / 440

35. Firewall
ROX™ v2.2 User Guide 373 RuggedBackbone™ RX5000
Interface Zone
w1ppp net
Table 35.3. Interfaces
35.3.3. Hosts
ROX™ firewall hosts are used to assign zones to individual hosts or subnets, on an interface which
handles multiple subnets. This allows the firewall to manage traffic being forwarded back out the
interface it arrived on, but destined for another subnet. This is often useful for VPN setups to handle the
VPN traffic separately from the other traffic on the interface which carries the VPN traffic. An example
follows:
Zone Interface IP Address or Network
local switch.0003 10.0.0.0/8
guests switch.0003 192.168.0.0/24
Table 35.4. Hosts
35.3.4. Policy
Firewall policies are the default actions for connection establishment between different firewall zones.
Each policy is of the form:
Source-zone Destination-zone Default-action
You can define a policy from each zone to each other. You may also use a wildcard zone of “all” to
represent all zones.
The default action describes how to handle the connection request. There are six types of actions:
ACCEPT, DROP, REJECT, QUEUE, CONTINUE and NONE. The first three are the most widely used
and are described here.
When the ACCEPT policy is used, a connection is allowed. When the DROP policy is used, a request
is simply ignored. No notification is made to the requesting client. When the REJECT policy is used,
a request is rejected with an TCP RST or an ICMP destination-unreachable packet being returned to
the client.
An example should illustrate the use of policies.
Source Zone Destination Zone Policy
loc net ACCEPT
net all DROP
all all REJECT
Table 35.5. Policies
The above policies will:
• Allow connection requests only from your local network to the Internet. If you want to allow requests
from a ROX™ console to the Internet, add a policy of ACCEPT fw zone to the net zone.
• Drop (ignore) all connection requests from the Internet to your firewall or local network, and
• Reject all other connection requests.
Note that a client on the Internet probing the TCP/UDP ports will receive no responses and will not be
able to detect the presence of the router. A host in the local network will fail to connect to the router,
but will receive a notification.
Note that the order of policies is important. If the last rule of this example were entered first then no
connections at all would be allowed.