RuggedCom RUGGEDBACKBONE RX5000 User Manual

35. Firewall
ROX™ v2.2 User Guide 375 RuggedBackbone™ RX5000
35.3.6. Rules
The default policies can completely configure traffic based upon zones. But the default policies cannot
take into account criteria such as the type of protocol, IP source/destination addresses and the need to
perform special actions such as port forwarding. The firewall rules can accomplish this.
The ROX™ firewall rules provide exceptions to the default policies. In actuality, when a connection
request arrives, the rules file is inspected first. If no match is found then the default policy is applied.
Rules are of the form:
Action Source-Zone Destination-Zone Protocol Destination-Port Source-Port Original-Destination-IP
Rate-Limit User-Group
Actions are ACCEPT, DROP, REJECT, DNAT, DNAT-, REDIRECT, REDIRECT-, CONTINUE, LOG
and QUEUE. The DNAT-, REDIRECT-, CONTINUE, LOG and QUEUE actions are not widely used
used and are not described here.
Action Description
ACCEPT Allow the connection request to proceed.
DROP The connection request is simply ignored. No notification is made to the requesting client.
REJECT The connection request is rejected with an RST (TCP) or an ICMP destination-unreachable packet being
returned to the client.
DNAT Forward the request to another system (and optionally another port).
REDIRECT Redirect the request to a local tcp port number on the local firewall. This is most often used to “remap”
port numbers for services on the firewall itself.
Table 35.7.
The remaining fields of a rule are as described below:
Rule Field Description
Action The action as described in the previous table.
Source-Zone The zone the connection originated from.
Destination-Zone The zone the connection is destined for.
Protocol The tcp or udp protocol type.
Destination-Port The tcp/udp port the connection is destined for.
Source-Port The tcp/udp port the connection originated from.
Original-Destination-IP The destination IP address in the connection request as it was received by the firewall.
Rate-Limit A specification which allows the rate at which connections are made to be limited.
Table 35.8.
Some examples will illustrate the power of the rules file:
Rule Action Source-Zone Destination-Zone Protocol Dest-Port Source-
Port
Original-Destination-IP
1 ACCEPT net:204.18.45.0/24 fw
2 DNAT net loc:192.168.1.3 tcp ssh, http
3 DNAT net:204.18.45.0/24 loc:192.168.1.3 tcp http - 130.252.100.69
4 ACCEPT fw net icmp
5 ACCEPT net:204.18.45.0/24 fw icmp 8
Table 35.9.
1. This rule accepts traffic to the firewall itself from the 204.18.45.0/24 subnet. If the default policy is to
drop all requests from net to the firewall, this rule will only accept traffic from the authorized subnet.
2. This rule forwards all ssh and http connection requests from the Internet to local system 192.168.1.3.

RuggedCom RUGGEDBACKBONE RX5000 Specifications

General

Brand	RuggedCom
Model	RUGGEDBACKBONE RX5000
Category	Switch
Language	English

Summary

Part I. Administration

1. The ROX Web Interface

Overview of the web interface, navigation, and configuration modes.

2. System Administration

Covers device management, system commands, user accounts, and software upgrades.

4. Basic Network Configuration

Configuration of IP interfaces, IPv4, and IPv6 addressing.

6. Alarms

Management of alarm subsystems, LED behavior, clearing, and acknowledging alarms.

8. Logging

Configuration of local and remote syslog connections for event logging.

9. SNMP Configuration

Setup for SNMP access, users, communities, and traps for network monitoring.

10. Authentication

RADIUS server configuration for centralized authentication and authorization.

12. Chassis Management

Information on hardware, module status, power controllers, and slot identification.

15. DHCP Server

Configuration of DHCP server, subnets, pools, and IP address assignment.

Part II. Network Interfaces and Ethernet Bridging

16. Ethernet Ports

Features for Ethernet port control, configuration, rate limiting, and diagnostics.

21. Port Security

Authorizing network access using Static MAC or IEEE 802.1X authentication.

25. Spanning Tree

IEEE standard Spanning Tree functionality for loop prevention and topology management.

26. Virtual LANs

VLAN features for network segmentation, traffic isolation, and port configuration.

27. Network Discovery

LLDP support for automated network discovery and topology information.

Part III. Routing and Security

28. ROX Routing Overview

Overview of IP routing, Ethernet port types, and routing IP packets.

29. Layer 3 Switching

Hardware-based IP packet forwarding and routing rules configuration.

30. Tunnelling

Configuration of IPsec, L2TP, and GRE tunnels for secure communication.

31. Dynamic Routing

Details RIP, OSPF, and BGP protocols for automatic route discovery.

35. Firewall

Stateful firewall system implementation for network security and access control.

36. Traffic Control

Bandwidth management per interface using basic or advanced traffic shaping.

38. Link Failover

Configuration of backup links for automatic failover upon main link failure.

Part IV. Appendices

Appendix A. Upgrading Software

Procedures for preparing and performing operating system software upgrades.

Appendix B. RADIUS Server Configuration

Configuration procedures for RADIUS servers for authentication services.

Appendix C. Setting Up An Upgrade Server

Instructions for setting up a repository for software upgrades.

Appendix D. Adding and Replacing Line Modules

Procedures for adding and replacing line modules within the chassis.

Appendix E. GNU General Public License

The license terms and conditions for software copying, distribution, and modification.