Tahoe 4681, Руководство пользователя

Страница: 22 / 52

14
Tahoe 4681 (4-port G.shdsl.bis/FastEthernet modem card)
-m < IP address >
During the masquerade process the outgoing interface’s IP address is used by default. The
option above allows force use of other address.
accept
A packet that matches the rule will be accepted, i.e. will be forwarded for further processing.
No other firewall rule will be apply.
deny
A packet that matches the rule will be dropped. No other firewall rule will be applied.
masq
A packet will be masqueraded, i.e. its IP address will be changed to the IP address of an
outgoing interface of the modem to allow access to the Internet to stations without public IP
addresses.
pat < IP address[:port] >
Do Port Address Translation, i.e. change the destination IP address (and port) and forward
the packet to another station in the network. Allows certain ports on the modem to be redi-
rected to stations without public IP addresses that are hidden from the outside network.
The modem always chooses the first matching rule from the list. So if the more general rule comes
first, and the more specific is later, then the former will be applied and the latter ignored. Thus the
specific rule has to be inserted before the general one, as in following example:
Tahoe> ipchains add -s 215.16.11.0/24 deny
Tahoe>
ipchains insert -s 215.16.11.5 accept
Commands above inhibit the access for the whole 215.16.11.0/24 subnet except the 215.16.11.5 ad-
dress.
The specific accept rule (concerning one IP address) has to be inserted before the general rule (con-
cerning the whole subnet), by using the insert command as in the example above or by adding the
specific rule first and then the general rule after.
Otherwise the router will always apply the first deny rule and will never reach the second one, as
the packet coming from 215.16.11.5 fits both of them and if the general one is first, then it will be
applied.
More examples:
Tahoe> ipchains add d 0.0.0.0/0 80-80 p tcp deny