Appendix D – IP Access Control
Setting IP access control
The golden rule with this feature is ‘Include before you exclude’ or to put it another way ‘Arrange allowed addresses in the list before the denied addresses’.
This is because the positions of entries in the list are vitally important. Once a range of addresses is denied access, it is not possible to make exceptions for particular addresses within that range. For instance, if the range of addresses from A to F are denied access first, then the address C could not be granted access lower down the list. Address C needs to be placed in the list before the denied range.
IMPORTANT: This feature should be configured with extreme caution as it is possible to deny access to everyone. If such an error occurs, see Clear IP access control for details about how to regain access.
In the list, access control addresses prefixed by ‘+’ are allow entries while those prefixed by ‘– ‘ are deny entries.
To define a new IP access control entry, click the Add button to display a popup dialog:
Network/Address
Enter the network address that is allowed or denied access. If a range of addresses is being specified then specify any one of the addresses within the range and use the Mask entry to indicate the size of the range. (See address range and mask sections)
The IP access control function uses a standard IP address and a net mask notation to specify both single locations and ranges of addresses. In order to use this function correctly, you need to calculate the mask so that it accurately encompasses the required addresses.
Single locations
Some of the simplest addresses to allow or deny are single locations. In this case you enter the required IP address into the ‘Network/Address’ field and simply enter the ‘Mask’ as 255.255.255.255 (255 used throughout the mask means that every bit of the address will be compared and so there can only be one unique address to match the one stated in the ‘Network/Address’ field).
All locations
The other easy setting to make is ALL addresses are allowed or denied. Using the mask
0.0.0.0as standard, the IP access control section includes the entry: +0.0.0.0/0.0.0.0.The purpose of this entry is to include all IP addresses. It is possible to similarly exclude all addresses, however, take great care not to do this as you instantly render all network access void. There is a recovery procedure should this occur.
50