ELSA Documentation


Filter-list

The filter list is ultimately put together from the object table and the rule table. As mentioned above, the union of sets is thus formed of all of the filters defined by the rules and objects. The default settings of the object and rule lists result in the following default filter list.

The IP filters are defined in a table with the following layout

Idx. Prot Source Src-netmask S-st. S-end Dst-address
WIN TCP 255.255.255.255 0.0.0.0 137 139 0.0.0.0
:

Dst-netmask D-st. D-end Action
0.0.0.0 53 53

The table fields have the following meaning:

O Idx.
  Unique index. This entry is required to enable the filters to be distinguished. The index may be four characters long and selected as desired.
O Prot
  Protocol that is to be filtered. Possible entries are TCP, UDP, ICMP and all.
  The setting all filters out every packet from the specified source network or to the destination network.
O Src address, Src-netmask
  A subnetwork of the local network for which the filter is valid can be entered here. A source address of 0.0.0.0 means that the filter is applied to all computers. A network mask of 0.0.0.0 means that the filter is applied to all networks (which also means all computers).
O S-st., S-end
  Source port range that is to be filtered. A range of 0 to 0 means that no source port is affected by this filter.
O Dst-address, Dst-netmask
  A subnetwork of the local network for which the filter is valid can be entered here. A destination address of 0.0.0.0 means that the filter is applied to all computers. A network mask of 0.0.0.0 means that the filter is applied to all networks (which also means all computers).
O D-st., D-end
  Destination port range that is to be filtered. A range of 0 to 0 means that no destination port is affected by this filter.
O Action
  The filter can discard (not forward) or accept (forward) a packet.

Network masks and IP addresses of 0.0.0.0 can be used as "wildcards". Specified computers and networks may be simultaneously subjected to targeted filtering while others pass the router unfiltered.

The tables are processed from top to bottom. As soon as a matching filter is found, the packet is handled accordingly.


© Copyright 2001, ELSA AG
http://www.elsa.de