User`s guide

Defining Filters and Firewalls
Example filters
Pipeline User’s Guide Preliminary January 30, 1998 6-19
Dst Port Cmp=None
Dst Port #=N/A
TCP Estab=N/A
These conditions specify the local net mask and IP address in the Src Mask
and Src Adrs fields. If an outbound packet has a local source address, it will
be forwarded.
14
Close the Filter profile.
An example IP filter for more complex security issues
This section describes an IP data filter that illustrates some of the issues you may
need to consider when writing your own IP filters. The sample filter does not
address fine points of network security. You may want to use this sample filter as
a starting point and augment it to address your security requirements.
In this example, the local network supports a Web server and the administrator
needs to provide dial-in access to the server’s IP address while restricting dial-in
traffic to all other hosts on the local network. However, many local IP hosts need
to dial out to the Internet and use IP-based applications such as Telnet or FTP,
which means that their response packets need to be directed appropriately to the
originating host. In this example, the Web server’s IP address is 192.9.250.5.
This filter would be applied as a data filter in a Connection or Answer profile.
In filter 01...Ip...Forward=Yes
In filter 01...Ip...Src Mask=0.0.0.0
In filter 01...Ip...Src Adrs=0.0.0.0
In filter 01...Ip...Dst Mask=255.255.255.255
In filter 01...Ip...Dst Adrs=192.9.250.5
In filter 01...Ip...Protocol=6
In filter 01...Ip...Src Port Cmp=None
In filter 01...Ip...Src Port #=N/A
In filter 01...Ip...Dst Port Cmp=Eql
In filter 01...Ip...Dst Port #=80
In filter 01...Ip...TCP Estab=No
In filter 02...Ip...Forward=Yes
In filter 02...Ip...Src Mask=0.0.0.0
In filter 02...Ip...Src Adrs=0.0.0.0