C-M-G
Series
Manual
© TDT GmbH
Chapter 5: Network Configuration
Seite 54 von 136
Kommando
Beschreibung
Perfect Forward Secrecy
Enable or disable Perfect Forward Secrecy (PFS)
Enabled: Discards all secrets previously used for key generation
making it impossible to draw conlusions on the previously
arranged session key (default: yes)
Encapsulating Security
Payload (ESP)
Use ESP (Encapsulated Security Payload) for authentication
(default)
Encryption Authentication PFS-Group
Authentication Header (AH)
AH (Authentication Header) is used for authentication
Note:
When using NAT-T protocol authentication via AH is
not possible
SA Lifetime
Lifetime of the Security Association (SA)
The value can be defined in seconds, minutes, hours or days.
(default 8h, maximum 24h)
5.8.4 Keys
In this menu the connection keys will be displayed (only automatic keying).
5.9 Linux Firewall (IPtables)
The Linux Firewall allows specific filtering and regulation tasks in the data traffic. The packet filter defines
rules, which determine whether single or successive packets are allowed to pass the access protection
system or if they should be blocked. Such a rule could for example be used to discard all packets, which
come from IP address 1.2.3.4.
Every network packet which is transmitted, received or forwarded, pass through a chain of rules e.g. drop
(abolish), accept, queue respectively userspace (buffering), exit chain or run chain (selecting another
chain). The individual rules within a sequence are processed from top to bottom.
5.9.1 Tables
IPtables groups its processing rules for networking packets in three tables.
Packet filtering (filter)
The default table will always be used, if no other table is explicitly specified. This table includes the
INPUT, FORWARD and OUTPUT chains. It is also possible to create userdefined chains.
Packet alteration (mangle)
In this table you will find the PREROUTING and OUTPUT chains and here special changes will be made
to packets for example to the ToS (Type of Service) or TTL (Time to life) time of the IP headers.
Network address translation (nat)
This table is responsible for all sorts of address conversion or port forwarding and consists of the
PREROUTING, OUTPUT and POSTROUTING chains. The chains found in these tables are called every
first packet of a new connection and lead to corresponding changes being made to the port or IP numbers
of the packets.
