Digi TransPort WR11 - Page 786

Configuring security Firewall
Digi TransPort® Routers User Guide
786
Specifying IP addresses and ranges in firewall rules
ip-range
The ip-range field of a firewall script rule identifies the IP address or range of addresses to which the
rule applies. The syntax for specifying an IP address range is:
i p- r ange = “ al l ” | “ f r om” i p- obj ect “ t o” i p- obj ect [ f l ags ] [ i cmp ] [ i cmpv6]
where:
i p- obj ect = addr [ por t - comp | por t - r ange]
f l ags = “ f l ags” { f l ags } [ ! { f l ags } ]
i cmp = “ i cmp- t ype” i cmp- t ype [ “ code” decnum ]
addr = “ any” | i p- addr | i pv6- addr | i pv6- host | addr 6- et h | addr 6- ppp [
“ / ” decnum ] [ “ mask” i p- addr | “ mask” hexnum ]
por t - comp = “ por t ” compar e por t - num
por t - r ange = “ por t ” por t - num “ <>” | “ ><” por t - num
i p- addr = I P addr ess i n f or mat nnn. nnn. nnn. nnn
decnum = a deci mal number
hexnum = a hexadeci mal number
compar e = “ =” | “ ! =” | “ <” | “ <=” | “ >” | “ >=”
por t - num = ser vi ce- name | decnum
ser vi ce- name = “ ht t p” | “ t el net ” | “ f t pdat ” | “ f t pcnt ” | “ pop3” | “ i ke”
| “ xot ” | “ snt p” | “ smt p”
In the above syntax definition:
n Items in quotes are keywords.
n Items in square brackets are optional.
n Items in curly braces are optional and can be repeated.
n The vertical bar symbol (“|”) means or.
ip-object
An ip-object consists of an IP address and an IP port specification, preceded by the keyword from or
to define whether it is the source or destination address. The most basic form for an ip-object is an IP
address preceded by from or to. For example, to block all packets destined for address 10.1.2.98 the
script rule is:
bl ock out f r om any t o 10. 1. 2. 98
You can specify an ip-object using an address mask, describing which bits of the IP address are
relevant when matching. The script processor supports two formats for specifying masks:
n Method 1: The IP address is followed by a forward slash and a decimal number. The decimal
number specifies the number of significant bits in the IP address. For example, if you wanted to
block all packets in the range 10.1.2.* the rule would be:
bl ock f r om any t o 10. 1. 2. 0/ 24
such as, only the first 24 bits of the address are significant.