Technical data

153
if present, defines the last destination IP address in a range. If not specified, <first dest ip addr>
is assumed to be 0.0.0.0, <last dest ip addr> is assumed to be 255.255.255.255.
-dm <dest ip mask>
where <dest ip mask>, when present, defines a mask to use when comparing the <first dest ip
addr>...<last dest ip addr> with the destination IP address in the IP packet. If not specified, the
destination IP mask is set to 255.255.255.255.
-dp <first dest port>[:<last dest port>]
where <first dest port> defines the first or only destination port and <last dest port>, if present,
defines the last destination port in a range. If not specified, the <first dest port> is assumed to be
0, the <last dest port> is assumed to be 0xffff.
-b
This option indicates that this filter should be tested twice; a first time with the source filter
information matched against the source information in the IP packet and the destination filter
information matched against the destination information in the IP packet; and a second time
with the source filter information matched against the destination information in the IP packet
and the destination filter information matched against the source information in the IP packet.
-c <count of times rule used>
indicates how many IP packets have matched this filter since the router was rebooted.
-tcp syn|ack|noflag
where
syn
is the TCP SYN flag,
ack
is the TCP ACK flag, and
noflag
means there is a TCP
packet AND neither the SYN flag or the ACK flag are set. This option is ignored if the IP
packet is not a TCP packet. If not specified, the TCP SYN and TCP ACK flags are not checked
when matching the IP packet with this filter.
Note:
MORE than one
-tcp
option in an IP filter may be specified. For example, to match this IP
filter against the initiation of a TCP connection,
-tcp syn
would be used. Only IP packets with
the TCP SYN flag AND NOT the TCP ACK flag set will match this IP filter.
To match the response to initiation of a TCP connection,
-tcp syn -tcp ack
would be needed.
Only IP packets with BOTH the TCP SYN and TCP ACK flags set would match this IP filter.
remoteName
Name of the remote router (character string)
Examples:
remote ipfilter flush forward internet
This command deletes all IP filters of type Forward on the remote interface internet.
remote ipfilter append forward drop -da 192.168.0.0 -dm 255.255.0.0 internet
This command w
ill deny any IP traffic whose destination address is 192.168.0.0 masked with 255.255.0.0 (i.e.,
matches IP addresses 192.168.0.0 through 192.168.255.255) to the remote internet.
remote ipfilter append forward drop -da 192.168.0.0:192.168.255.255 internet
This command has the SAME effect as the previous filter.
remote ipfilter list forward internet
This command will list all IP filters defined of type Forward on the remote internet.