Chapter 11 - TCP/IP Filtering | 189 |
|
|
Rules that have been specified using CompatiView may be edited or exam- ined through the command line interface, and
Basic IP Packet Filter Rules and Syntax
At a minimum, every
Every line in a packet filter set must begin with the actions permit or deny, or the comment indicator #.
•Lines which begin with permit specify that packets meeting the condi- tions should be passed through the filter.
•Lines which begin with deny specify that packets meeting the conditions should be dropped by the filter.
•Lines which begin with # specify that the text on the line is a comment and should be ignored.
Every line which begins with permit or deny must be followed by a source and destination IP address. These IP addresses can be specified in a number of different ways.
•Addresses can be specified in
•A factorized format can also be used where a set of components are substituted into an address. These addresses take the form of #.#.#.{#,#,...}. For example, 192.12.9.{1,2,15} matches the hosts 192.12.9.1, 192.12.9.2, and 192.12.9.15. The factor set must be at the end of the address, but addresses of the form #.{#,#,...}, #.#.{#,#,...}, etc., are allowed. Any components past the factor set’s position are implicitly assumed to be 0.
ϖNote: When the factorized format is used, one line is substituted for many. However, when the device reads the filters and installs them, it expands each address into a separate rule. In the example given, three rules would be created. This can make the number of rules to process greater, which can affect performance.
•IP addresses may also be specified as a hexadecimal number (for example, 0x82cc0801 matches the host address 130.204.8.1).
Any address may have an optional /bits field at its end. This denotes the number of bits, starting with the most significant, that will be considered by
