TCP/IP packet filtering | USRobotics NETServer/8, NETServer/16

TCP/IP packet filtering

After the filter name, rule number and permit/deny, IP rules start with the following parameters:

<source address/mask> <destination address/mask> <tcp udp icmp>

Depending on the protocol, there can be more options following these parameters. See TCP and UDP parameters and Filtering ICMP packets (below) for more information.

Source Address

The address given here is compared to the source address of the packet. Note that only the part of the address specified by the mask field is used in the comparison. If a match is found, the packet is forwarded (rules containing permit) or discarded (rules containing deny).

The following rule example permits source addresses that match the first 16 bits of the given IP address (that is, addresses begin- ning with 192.77):

permit 192.77.200.203/16

Note: The source address and destination address fields gener- ally are used to limit permitted access to trusted hosts and networks only, to explicitly deny access to hosts and networks that are not trusted, or to limit external access to a given host (for example, a web server or a firewall). For example, the following rule permits (SMTP) E-mail packets only if they are from the host 192.77.203.24.

permit 192.77.203.24/32 0.0.0.0/0 tcp dst eq 25

8-8 Packet Filters

Image 122

USRobotics NETServer/8, NETServer/16 manual TCP/IP packet filtering

Contents

NETServer/8 NETServer/16 Page Table of Contents Network Dial-in Access Administrative Tools Reference Section Warranty and Service Limited Warranty Vii Service and SupportTechnical Support We welcome your suggestions for better documentation Viii Additional Software Enhancements Chapter OverviewWhat’s New with Release 3.1? Overview Accounting Servers Netmask TableIP Address Spoofing Accounting Server Support Radius Accounting and ANI/DNIS Multiple Name ServersRandomized Hosts Icmp Message Logging New Modem Port Features NETServer Overview IP Modem Sharing How do I get there from here? Administrative Utilities Security Basic Installation Chapter Basic InstallationSystem Administrator Requirements TCP/IP Reference Material Accessing the Command Line Getting Started Getting the LAN port up and running First step for IPX or IP/IPX networks Basic Installation IP Configuration You must also set the Broadcast Address. Type the following IPX Configuration Ethernet802.3 ethernet802.2 ethernet802.2II ethernetII Final Steps IP and IPX Default Gateways Recommended Global ConfigurationPassword To set the IP gateway, type the following Name Service Save your work Basic Installation Configuration Overview Chapter Configuration OverviewHow to Setup Applications Where do I go from here? Application Section You can abbreviate commands Command LineCommands are not case sensitive Separate a parameter and its value by a space How to log out of the command line Reset any ports you have changedReboot when necessary Save your changes Quick Command Overview Hosts Table Overview of configurable tablesGlobal Configuration Location Table Initialization Script ConfigurationNet0 LAN Port Configuration Netmasks Table Packet Filter Table Port Configuration Port Type Snmp Configuration Routes Table User Table Configuration Overview IP Terminal Server Setup Chapter IP Terminal Server SetupTerminal or Workstation Setup NETServer Terminal Server Setup Overview User Table Port DefaultGlobal Default Set the port type to User Login Terminal Server Detailed SetupConfiguring a Port Set the port’s security Pass-Thru Login Create default user settings for the port Port Default Login Service Optional Friendly Stuff Save sport # Add the user to the User Table Configure the userAdding a Remote User to the User Table Login Service Configure for dialback use? IP Terminal Server Case Studies Example NETServer will use ports 6, 7, and 8 for this application Save your work and reset all the ports Example IP Terminal Server Setup Network Dial In Access Chapter Network Dial In AccessDial-in User Setup NETServer Setup for Network Dial-In Overview Prework Configuration NETServer Dial-In Detailed Setup Dialback Users on this Port? Save the changes to flash memory Create a new user Normal or dialback user? Add configuration information for the user This is the user’s IP subnet mask. Use the following command Option can be any one of the following IP Remote Access Case Study Configure the ports Create user table entries for the dial in users Create a user table entry for the dialback user Save your work and reset the ports Connecting to the NETServer IPX Remote Access Create User Table entries for the dial in users LAN-to-LAN Routing Setup for NETServer Routing OverviewChapter LAN-to-LAN Routing IPX routing LAN-to-LAN Routing An Introduction to NETServer Routing NETServer Routing LAN-to-LAN Routing Static vs. Dynamic Routes How RIP Dynamically Builds the Routing Table How Packets are Routed Establishing Connections to Remote Gateways Routing Procedure PAP/CHAP Authentication PAP Password Authentication Protocol Chap Setup for the NETServer Chap Challenge Example LAN-to-LAN Routing Detailed Setup Configuring the Port Creating a Dial-Out Group Set Required Location Parameters Adding a Remote Device to the Location TableCreate a new location table entry This is the remote device’s IP address Set location location name netmask netmask Dial Group Number Multiple lines for a single connection Maximum Ports Create a Dial Script Set location Chicago script 1 atds slot#\r Connect Tell the NETServer about the Remote Device Adding the Remote Device to the User TableCreate a User Table Entry Set user user name protocol ppp slip Set netuser user name compression on off LAN-to-LAN Routing Case Study Setting Up NETServer a Add netuser nsb password xyzabc Setting Up NETServer B Now, save your work and reset the ports Testing the Connection Connecting to NETServer a from NETServer B What If I Don’t Want to Use Chap Authentication? TCP/IP Modem Sharing Configure the port as a host deviceChapter Talking to the Modems Assign the modem a TCP port number Save your work and reset the port Turn modem control carrier detect off Implementing Security with Host Device Dial Out Configuring modems as Unix pseudo TTYs Talking to the Modems Add a New Initialization Script Modem Initialization ScriptsHow To Assign Text to an Initialization Script Displaying an Initialization Script Use an Existing Initialization ScriptDelete an Initialization Script Default initialization string Initialization Script Example Sending AT commands to the modems Talking to the Modems Packet Filters Chapter Packet FiltersPacket Filters Types of Filters Packet Filters and the NETServer Input filters vs. Output filters Information Sources Adding Packet Filters Input filters vs. Output filters Name Filter Rule FormatRule Type Options Rule NumberPermit or Deny TCP/IP packet filtering Destination Address TCP and UDP parameters Standard Port Numbers TCP UDP Filtering RIP messages FTP Packet Filtering Client opens a control channel FTP Example Filtering Icmp packets Type Description IPX packet filtering IPX Rules Dsthost SAP Rule Options Delete a Packet Filter Rule Editing Packet FiltersEdit a Packet Filter Delete a Packet Filter View a Packet Filter View the Packet Filter Table Changing the command prompt Chapter Administrative ToolsConfiguring the !root account Root Access Telnet Access Port Nslogin, Rlogin and Telnet Commands Manually Connecting to a Remote SiteDial Command Troubleshooting Commands Viewing Debug messages Turn off the output console by typing the following Ifconfig MTU Ping Ptrace Traceroute Version Show command Show Show arp Show flash Show memory Show netconns Show netstat Show sap Show sessions Administrative Tools Command Reference Chapter Command ReferenceGlobal Configuration Save Changes View the Global Configuration TableGet help Assigned Address Default HostGlobal user parameters Connect Message Randomize Hosts Default Gateways Global routing parameters Default Route IP Address Spoofing Proxy ARP NetBIOS Packet PropagationPAP Authentication System Name Server name Name ServiceService DNS Cache Reset Time-out Domain name Alternate Radius Server Radius securityPrimary Radius Server Radius Secret Radius Accounting Syslog Accounting Icmp Logging Delete a Host Hosts TableAdd a Host View the Hosts Table Add a Location to the Location Table Bring Up the List of CommandsLocation Table Change a Location’s Parameters View a Particular Location Save Location Table ChangesView the Location Table Location Table Parameters Connection Type IPX Network IP AddressNetmask Compression ProtocolRouting Dial Group Maximum Ports Idle Time-out High Water Mark MTU PPP Async Map Dial Script Output FilterInput Filter Send Reply LAN Port Net0 Configuration Reset the Network Interface Card Ethernet Status View LAN Port ConfigurationLAN Port Parameters Configured Ethernet Media Interface Address Broadcast Address IPX Frame Type Set net0 ifilter filter name Delete a netmask Netmask TableAdd a netmask View the netmask table Save Port Configuration Change a Port’s Parameters To view all of the S-ports, use the following command View the Ports Table Idle Port is idle View an Individual Port Host Device User LoginDetermining a Port’s Type Device Service Network Line Hangup Login MessageDial In Port Parameters Login Prompt Security Pass-Thru Login Autolog Name User Login Port ParametersDialback Delay Host Login Service Terminal Type Hardwired Port Parameters IPX Network Number Set s0 netmask netmask NETServer sends RIP information across Databits Serial Communications ParametersPort Speed Stopbits Host Override ParityFlow Control Modem Control Change a Route’s Information Routes Table ConfigurationAdd a Route to the Routes Table View the IP Routes Table Delete a Routes Table EntrySave Routes Table Changes Viewing the IPX Routes Table Flag Parameter IP Parameters IPX Parameters Save the Snmp Table Changes Snmp TableDelete Snmp Hosts Enabling/Disabling Snmp Read Community Name Snmp Table ParametersView Snmp Table Write Community Name Read Hosts Write Hosts User Table Add a User to the User Table Save User Table Changes Change a User’s ParametersDelete a User View the User Table Dialback Number Login User ParametersAccess Filter Set user name service rlogin telnet netdata portmux Command Reference Network User Parameters Dialback IPX connections require the PPP protocol NETServer sends RIP information to the dial Set user filter name ofilter filter name Command Reference Appendix a Technical Specifications 16 port NETServer Hardware Maximum Input Power Power RequirementsMaximum Output Power Typical Input Power Technical Specifications A-3 External Serial Port Console Ethernet Network Interface Card 10Base-T 10Base-2 BNC SignalTechnical Specifications A-5 Isolated GND Technical Specifications Token Ring Network Interface Card Token Ring⎯STP ConnectorTechnical Specifications A-7 Token Ring⎯UTP Connector Technical Specifications A-9 NETServer Firmware SpecificationsAdministration Routing Support Client Dial-up Support PPP Specific FeaturesIndustry Standards Support Technical Specifications A-11 Slip and PPP Client Software Support Technical Specifications IP Addressing Basics Appendix B Addressing SchemesIPX Addressing Basics Addressing Schemes B-1 Addressing Schemes Address ClassesSubnetting Mask Binary Subnets Hosts Addressing Schemes B-3 Reserved Addresses Supernetting Advanced TCP/IP Addressing Schemes B-5 Cidr Each Supernet is treated as a single entity Addressing Schemes B-7 Step two Select a range of addresses for each supernet Addressing Schemes B-9 Supernetting and the NETServer Appendix C Software Download SDL Using a Direct Connection to a PCWhy Perform an SDL Software Download? Software Download C-1 Loading the Software Download SDL Program Make Backup Copies of the NETServer FirmwareSoftware Installation Starting SDL SDL Command Syntax Software Download C-3 Optional -d Parameter Filename Prefixes Entering SDL Mode Software Download C-5 From the Windows Management Software Upgrading NETServer Firmware Upgrading the Modem Firmware Software Download C-7 For the Isdn NETServer, the file names are Error Messages Software Download C-9 PC SDL program detected unknown command line argu- ments Software Download C-11 Invalid Control Word Software Download C-13 File you are trying to download is not a NETServer file Appendix D Boot Process Boot Process D-1 Boot Process Syslog Accounting E-1 Using SyslogAppendix E Syslog Accounting Syslog System Message Format Syslog System MessagesSpotting Unused Ports Syslog Accounting Syslog System Message Examples Syslog Accounting E-3 Someone has logged in as !root on port S16 Syslog Accounting E-5 Syslog Accounting Appendix F Obtaining Radius Security a Centrally Managed User Table Setting Up Radius User Table Entries Authentication Items Response Items Radius F-5 Framed-Netmask Radius F-7 User Types Radius F-9 Making NETServer talk to a Radius security server Chap authentication using Radius Radius accounting fields Acct-Delay-TimeRadius Accounting Acct-Status-Type Acct-Session-Time Accounting ExamplesAcct-Authentic Radius Alphabetical Index Index Index Icmp MTU NIC PPP SAP Slip Index Index