Firewall Configuration Example 559
www server address 129.38.1.3. The enterprise address to the outside is
202.38.160.1.Address conversion has been configured on the router so that the
internal PC can access the Internet, and the external PC can access the internal
server. By configuring a firewall, the following are expected:
■Only specific users from external network can access the internal server.
■Only a specific internal host can access the external network.
In this example, assume that the IP address of a specific external user is
202.39.2.3.
Figure 172 Sample networking of firewall configuration
1Enable firewall
[Router]firewall enable
2Configure firewall default filtering mode as packet pass permitted
[Router]firewall default permit
3Configure access rules to inhibit passing of all packets
[Router] acl 101
[Router-acl-101] rule deny ip source any destination any
4Configure rules to permit specific host to access external network, to permit
internal server to access external network.
[Router-acl-101] rule permit ip source 129.38.1.4 0 destination any
[Router-acl-101] rule permit ip source 129.38.1.1 0 destination any
[Router-acl-101] rule permit ip source 129.38.1.2 0 destination any
[Router-acl-101] rule permit ip source 129.38.1.3 0 destination any
5Configure rules to permit specific external user to access internal server
[Router] acl 102
[Router-acl-102] rule permit tcp source 202.39.2.3 0 destination
202.38.160.1 0
Enterprise Ethernet
Quidway router
www server
Specific internal PC
WAN
129.38.1.3
Ftp server
129.38.1.1 Telnet server
129.38.1.2
1
29.38.1.4
129.38.1.5
202.38.160.1
Specific external PC
Router