Individual Rule Screen
This screen allows you to configure each rule in the filter set.
You are allowed to create up to 12 filter sets and up to 6 rules for each filter set.
Click
on the fields in the image below to go to the corresponding description. |
 |
Description |
The PNC provides a list of predefined filter types
in the Rule Type pull-down list to help you in creating your own filter
rules. With these types, you will be able to base your rules on applications (WWW, FTP,
DNS, SMTP mail, etc.), sites (IP addresses), or TCP/UDP ports. Or you can create
specialized rules based on other criteria with the custom types, as explained in Custom
TCP/IP and Custom Generic Types below.
Custom TCP/IP and Custom Generic Types
Select the Custom TCP/IP or the Custom
Generic rule type to create your specialized rules.
The More switch is common in both screens. If this switch is off, a
packet matching the rule is immediately dropped or forwarded, depending on whether you
choose Restrict or Allow in the Filter Action
field. However, if the switch is yes, the Filter Action field will be dimmed
and a matching packet is passed to the next rule. This mechanism allows you to chain
multiple rules together to create a compound rule. A matching packet will have to go
through the chain of rules before an action is taken.
- Custom TCP/IP
The Custom TCP/IP type allows you to base a rule on the fields in
the IP or upper layer, e.g., UDP and TCP, headers. Rules of this type are used to create
Protocol type filter sets.
The Protocol box contains the upper layer protocol number, e.g., TCP is
6, UDP is 17 and ICMP is 1. If the Source Route switch is set to no, a
packet must not contain source routes (an IP option) to match the rule. The Address,
Subnet Mask and Port Number fields are for you to enter the
respective value for either the source or the destination of the packet. The Port #
Compare list allows you choose the comparison to apply to the port number in the
packet to that in the filter rule, e.g., if you choose Greater Than and the Port
Number is 1023, then all packets with port number 1024 and above will match the
rule.
The TCP Established switch is applicable only when the Protocol
is 6, i.e. TCP. If it is yes, then the rule applies only after the TCP connection has been
established. Otherwise, the rule applies to all TCP packets.
- Custom Generic
The Custom Generic type is used to create Device type filter sets. This
rule type treats the packet as a byte stream. There are four parameters, namely Offset,
Length, Mask and Value that you must enter. The
portion of the data to compare is specified with the offset (starting from 0) and the
length (both in bytes). The Prestige applies (logically ANDing) the mask to the data
before comparing it to the value.
|
- Active: This activates/deactivates
this rule.
Filter Action: This determines what to do
with a packet matching this rule. The choices are:
- Drop:
Restrict drops a matching packet, while Allow tells the
Prestige to forward the packet if there are no more rules in the set.
- Next Rule:
If there are more rules, then the packet will be passed along to the
next rule. A packet that does not match the rule is always passed to the next rule.
- Log Filter Rule:
You can use the filter logging facility to help to debug your
filters. The choices are:
- None
: Does not generate any log entry.
- Packet Matched
: Generates a log entry only when a packet matches the rule.
- Packet Not Matched:
Generates log entries for packets not matching this rule.
- Both
: Generates log entries for both matched and unmatched packets.
The log is sent to a logging server using UNIX syslog facility. Please note that the Both
choices in effect generate a log entry per rule for every packet passing through a port.
It could easily overwhelm the Prestige and should be avoided if possible.
|
|