3Com 812 manual Accept src-addr=xxx Accept dst-addr=yyy Deny

6-30CHAPTER 6: MANUAL SETUP

Field	Description
line #	Each rule must have a unique line number from 1-10 plus 999 for the DENY verb.
	You must arrange rules in increasing order.
Verb	This field can be one of the following:
	ACCEPT - Allow the packet access if the condition is met (use with DENY verb to
	indicate reject all other packets).
	REJECT - Do not allow the packet access if the condition is met.
	AND - Logically use the AND condition with condition of the next rule to
	determine if the packet is accepted or rejected. Both defined conditions must be
	met.
Keyword	The keywords for all protocol, descriptions, corresponding operators and values.
Operator	Describes the relationship between the keyword and its value. The operator field
	must be one of the following:
	= Equal
	!= Not equal
	> Greater than
	< Less than
	>= Greater or Equal
	<= Less or Equal
	=> Generic
value	Contains a entity that is appropriate for the keyword.

The OR operation can be implemented by successive rules. For example, to accept a packet if the source address is xxx, or the destination address is yyy, the following rules are used:

IP:

1ACCEPT src-addr=xxx;

2ACCEPT dst-addr=yyy;

999DENY;

(This will only accept packets from the specified address(es); all other packets will be rejected.)

The following table describes the keywords for each protocol section and their legal operators used in the rule syntax. Value ranges are also given where ddd is a decimal between 1 and 255, mask is a decimal between 1 and 32, and xx is a hex number:

Table 6-4Protocol Keywords

Protocol
Section	Keyword	Operators	Description and Value Range
IP	src-addr	=, !=	Source IP Address (ddd.ddd.ddd.ddd/mask)
	dst-addr	=, !=	Destination IP Address (ddd.ddd.ddd.ddd/mask)
	tcp-src-port	all	TCP source port (1 - 65535)
	tcp-dst-port	all	TCP destination port (1 - 65535)
	udp-src-port	all	UDP source port (1-65535)
	udp-dst-port	all	UDP destination port (1-65535)
	protocol	=, !=	IP protocol (UDP, TCP, ICMP)
	generic	=	Generic filter
IP-RIP	network	=, !=	IP network number (ddd.ddd.ddd.ddd/mask)