Technical data

Table Of Contents

100

When the packet is accepted at a filter interface (Input, Forward, or Output), the router lets it proceed for

further processing.

Drop

With Deny, the packet is silently discarded.

Reject

With Reject, an ICMP REJECT (Internet Control Management Protocol) is sent to reject the packet.

IP filter commands

The following two commands are used respectively to define IP filters on the Ethernet interface and on the remote

interface. For extensive information on the syntax of these two commands, please refer to the

Command Line

Interface Reference

chapter.

eth ip filter

<command> <type> <action> <parameters> [<port#>]

remote ipfilter

Special notes

IP filters of Input type are checked BEFORE the IP packet is redirected by ICMP. This could adversely affect

local LANs that use ICMP redirect to dynamically learn IP routes. IP filters of Input type are checked BEFORE

the IP packet is sent to the router itself as a host.

Example:

The following commands will stop ANY attempt by a host coming from the remote <internet> from sending an IP

packet to the telnet port. Hence, the router will not see the packet; the packet will not be forwarded anywhere.

remote ipfilter insert input drop -p tcp -dp 23 internet

save

These commands will stop ANY attempt by a host coming from the remote <internet> from sending an IP packet

to the telnet port "through" the router to a different interface. The router itself could still receive the IP packet so

the remote host could telnet to the router itself.

remote ipfilter insert forward drop -p tcp -dp 23 internet

save