XnetSolutions SX-GATE, Руководство пользователя

Страница: 316 / 480

14.2.2 Policies 316
Automatic NAT will only apply to IPv4 connections originating in LAN or RAS
zones with an Internet destination, except for DS-Lite Internet links.
It is possible to associate a specific NAT IP address with each rule. This way you
can create a static mapping between an internal and an external IP address if SX-
GATE has multiple Internet IP addresses. If you do not impose an IP, SX-GATE
will automatically use the interface's primary IP.
You must not enter an address here if a dynamic IP is
assigned to SX-GATE.
You can even establish a static 1:1 mapping between two networks by entering
a network address with a corresponding netmask. For example the entry
"10.0.0.0/24" will replace the first three octets of any source IP with "10.0.0", so
e.g. the source IP "192.168.1.254" is mapped to "10.0.0.254".
Dest. (
…
)
If you leave these fields blank, the rule will apply to any destination IP. To grant
access to a single server only, please enter its IP address. To give access to a
whole network, specify the network address and its corresponding netmask (e.g.
192.168.0.0/24). To configure a rule for multiple individual clients or networks,
define a new group in menu "Definitions > IP objects" or select an entry from the
list of available groups.
Comment
Use this field for documentation. Up to 14 characters from this field will be included
in the log if logging is enabled for this rule.
14.2.2-H Options
Automatic blocking of suspicious IPs (dynamic firewall)
The firewall continuously registers connection attempts to blocked ports, connection
rates exceeding the limits specified in firewall rules, portscans and also pings or
traceroutes by source IP. If a threshold is exceeded for an IP address, it may be
automatically blocked for a certain period of time.
Block privat IP addresses (RFC-1918 and RFC-4193)
If this switch is activated, all packets that run via this interface will be
checked for IP addresses from the following networks: 192.168.0.0/255.255.0.0,
172.16.0.0/255.240.0.0 and 10.0.0.0/255.0.0.0 as well as fc00::/7. All incoming and
outgoing packets with corresponding source or destination addresses will be discarded.
Fake reply to incoming Traceroute and ICMP-Ping
When this option is active, the firewall will reply to incoming ICMP echo-request
regardless of the actual destination IP. Incoming packets with a low TTL value may
indicate an incoming traceroute. Also these packets will be answered by the firewall.