Cyclades AlterPath BladeManager Manuál s instrukcemi stáhnout pdf (Strana 67)

Chapter 4: Administration Introduction 53

Firewall/Packet Filtering on the MergePoint 5224/5240 SP

Manager

Packet filtering on the SP manager is controlled by chains and rules that are configured in iptables.

For more details about predefined chains and rules, see Chains on page 53 and Rules on page 54.

Both the Web Manager and the cli utility provide a way for the administrator to add rules and to

edit or delete any added rules:

• Because the SP manager filters packets like a firewall, the Web Manager menu option under

Network is titled Firewall.

• The cli utility provides the iptables command to perform the same tasks, because when rules

are added, edited or deleted, the corresponding iptables are updated.

By default, the SP manager does not forward any traffic between private and public networks. The

administrator might want to add rules to allow some limited communications between specific

target devices on the private network and the public network.

CAUTION: It is possible for an administrator to create rules that circumvent the access controls on a

target device.

Chains

A chain is a kind of named profile that includes one or more rules that define the following:

• A set of characteristics to look for in a packet

• What to do with any packet with all the defined characteristics

The SP manager comes with a number of built

-in chains with hidden rules that are preconfigured to

control communications between target devices that are connected to the private Ethernet ports and

devices on the public side of the SP manager. The default chains are defined in filter and nat

iptables. The mangle table is not used.

The built

-in chains are named according to the type of packets they handle, as shown in the

following lists. The first three chains are in the iptables filter table: INPUT, OUTPUT

and FORWARD.

The three chains in the nat table are: PREROUTING, POSTROUTING and OUTPUT. These

chains implement NAT (network address translation) including the redirecting of packets

addressed to a virtual IP to the target device’s real IP address and the hiding of the target device’s

real IP address when the target device sends packets to the authorized user.

1 2 ... 62 63 64 65 66 67 68 69 70 71 72 ... 239 240

Žádné komentáře

Cyclades AlterPath BladeManager Manuál s instrukcemi Strana 67