Tahoe 4681, Руководство пользователя

Страница: 21 / 52

13
Tahoe 4681 (4-port G.shdsl.bis/FastEthernet modem card)
You can assign an IP address to an interface, together with subnet mask and broadcast address.
You can also enable or disable dynamic Address Resolution Protocol (ARP, enabled by default).
ipchains
This command is used to control the firewall and the network address translation (NAT, called
also “masquerade” – gives network an access to the Internet using only one public IP address).
To configure the firewall you should make a list of rules that define actions that should be taken
when a matching packet is received.
ipchains add
– adds an entry at the end of the list
ipchains insert
– adds an entry at the beginning of the list
ipchains del
– removes an entry
ipchains list
– displays current settings
ipchains flush
– removes all entries from the list
After the add , insert or del option, following parameters can be added:
Tahoe> ipchains { add | insert | del } [-s < source subnet > / < netmask >
[ < port range > ]] [-d < destination subnet > / < netmask > [ < port range > ]] [-p
{ tcp | udp | icmp }] [-y] [-m
<
IP address
>
] { accept | deny | masq |
pat < IP address > [: < port > ]}
-s < source subnet > / < netmask > [ < port range > ]
Defines the source addresses that this entry concerns. If this parameter is omitted, then the
entry applies to all source addresses. The port range can be specified only if the TCP or UDP
protocol is selected using -p option.
-d
<
destination subnet
>
/
<
netmask
>
[
<
port range
>
]
Defines the destination addresses that this entry concerns. If this parameter is omitted, then
the entry applies to all destination addresses. The port range can be specified only if the TCP
or UDP protocol is selected using
-p option.
-p { tcp | udp | icmp }
Optionally the application of this rule can be limited to a specified protocol
-y
The rule can be applied to the TCP SYN packets only (i.e. the packets that initiate the TCP
connection). It allows inhibiting the incoming connections while the returning packets for
the outgoing connections will pass.