
104 C
HAPTER
7: S
ETTING A
P
OLICY
Rules are arranged in order of precedence from the most specific to the
most general.
For example if you block all FTP traffic in one rule and allow a machine
with a specific IP address to use FTP in another rule then the second rule
will override the first and will be displayed above it.
The table is divided into columns as follows:
Rule Number (#)
Rules are consecutively numbered by precedence and new rules will be
inserted into the list by the Firewall at a position appropriate to the
breadth of scope of the rule.
When evaluating rules, the Firewall uses the following criteria:
1 A rule defining a specific service is more specific than the default rule.
2 A defined Ethernet link, such as LAN, WAN, or DMZ, is more specific than
* (all).
3 A single IP address is more specific than an IP address range.
Action
The Action for a rule can be set to either Allow or Deny traffic across the
Firewall. For security reasons common protocols are often denied and
more specific rules created to describe where these protocols are used
legitimately.
Service
The Service for a rule shows the service (and hence the protocol) over
which the rule operates. A value of Default indicates that the rule
operates on all traffic. Other values for Service are defined in “Adding
and Deleting Services” on page 101.
Source
The Source of a rule indicates where the connection for that rule is
originated. The source can be set to LAN, DMZ, WAN or an specific
address or range of addresses on one of those ports.
When a connection is made a two-way conversation is initiated. When
allowing a PC on the LAN network port to communicate with a PC or
Server on the WAN network port (e.g. to Browse using HTTP) it is
unnecessary (and inadvisable) to set a rule for the reverse journey. This
DUA1611-0AAA02.book Page 104 Thursday, August 2, 2001 4:01 PM
Comentarios a estos manuales