CONEL SPECTRE v3 ERT — настройка брандмауэра: управление доступом и фильтрация пакетов [56/136]

Превью страниц Страница 56 / 136

4. CONFIGURATION

4.8 Firewall Conﬁguration

The ﬁrst security element which incoming packets pass is a check of the enabled source

IP addresses and destination ports. You can specify the IP addresses as an IP address from

which you can remotely access the router and the internal network connected behind a router.

To enable this function, marking the Enable ﬁltering of incoming packets check box located

at the top of the Firewall Conﬁguration page. Accessibility is checked against the IP address

table. This means that access is permitted only to addresses speciﬁed in the table. It is pos-

sible to specify up to eight remote IP addresses for access. You can specify the following

parameters:

Item Description

Source IP address from which access to the router is allowed.

Protocol Speciﬁes the protocol used for remote access:

• all – Access for all protocols is active.

• TCP – Access for the TCP protocol is active.

• UDP – Access for the UDP protocol is active.

• ICMP – Access for the ICMP protocol is active.

Target Port The port number on which access to the router is allowed.

Action Speciﬁes the type of action the router performs:

• allow – The router allows the packets to enter the network.

• deny – The router denies the packets from entering the network

Table 31: Filtering of Incoming Packets

The next section of the conﬁguration form speciﬁes the forwarding policy. If you unmark

the Enabled ﬁltering of forwarded packets check box, then packets are automatically accepted.

If you activate this function, and a packet is addressed to another network interface, then the

router sends the packet to the FORWARD chain. When the FORWARD chain accepts the

packet and there is a r ule for forwarding it, the router sends the packet. If a forwarding rule is

unavailable, then the router drops the packet.

This conﬁguration form also contains a table for specifying the ﬁlter rules. It is possible

to create a rule to allow data with the selected protocol by specifying only the protocol, or to

create stricter rules by specifying values for source IP addresses, destination IP addresses,

and ports.