Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| firewall:example_1 [2010/11/04 12:15] – tibor | firewall:example_1 [2010/11/04 12:46] (current) – tibor | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | [[tutorial|Firewall rule tutorial]] example 1: | ||
| + | |||
| ====== Modifying a standard rule ====== | ====== Modifying a standard rule ====== | ||
| - | **A good understanding of how firewall rules work can be achieved by marking checkboxes on the Security Profile pages, and examining what new rules they add to the firewall rules:** | + | ^ :!: This description is addressed to advanced users only. ^ |
| + | | Incorrect editing of the firewall rules may cause security risks! | | ||
| + | |||
| + | **A good understanding of how firewall rules work can be achieved by marking checkboxes on the [[web GUI:Security Profile]] pages, and examining what new rules they add to the [[web GUI:firewall rules page|firewall rules]].** | ||
| Say you have a telnet server (192.168.0.10) that you want **only one** remote PC (11.50.17.69) on the Internet be able to access. Using the Security Profile page you can enable access of the Telnet server, but that allows all Internet PCs to access your server! Using the Security Profile page you cannot control firewall behaviour more precisely – but by editing the rules manually you can! | Say you have a telnet server (192.168.0.10) that you want **only one** remote PC (11.50.17.69) on the Internet be able to access. Using the Security Profile page you can enable access of the Telnet server, but that allows all Internet PCs to access your server! Using the Security Profile page you cannot control firewall behaviour more precisely – but by editing the rules manually you can! | ||
| - On the [[web GUI: | - On the [[web GUI: | ||
| - | - Now if you open the [[web GUI: | + | - Now if you open the [[web GUI: |
| | ...\\ (dport == sip' | | ...\\ (dport == sip' | ||
| Line 16: | Line 21: | ||
| Now it is fairly simple to modify that rule by adding one more restriction. We would like a rule like this: | Now it is fairly simple to modify that rule by adding one more restriction. We would like a rule like this: | ||
| - | **(saddr == 11.50.17.69) && | + | **(saddr == 11.50.17.69) && |
| The modified rule would mean: “if the incoming packet **is coming from 11.50.17.69 and** tries to access port 23, and is a TCP protocol packet, then forward it to PC 192.168.0.10" | The modified rule would mean: “if the incoming packet **is coming from 11.50.17.69 and** tries to access port 23, and is a TCP protocol packet, then forward it to PC 192.168.0.10" | ||
| Line 29: | Line 34: | ||
| - click Apply | - click Apply | ||
| - | | LINE | Incoming user | post | (saddr == 11.50.17.69) && (dport == 23) && proto == tcp modify static daddr 192.168.0.10 | | + | | LINE | Incoming user | post | (saddr == 11.50.17.69) && (dport == telnet' |
| If you open the [[web GUI: | If you open the [[web GUI: | ||
