Verilink 8100A (34-00237) Product Manual - Manual (Page 299)

A p p l i c a t i o n s N o t e s D-7
IP Packet Filtering Syntax and Grammar
Each packet is compared to all the rules in the list for the interface and
direction, with the last matching rule being applied (exception: see “quick”
command below). Therefore, the most restrictive rules (block) should be
placed first in the list, with pass rules following. This will allow only certain
packet types to traverse the IAD.
NOTICE: When modifying or deleting PVCs, the interface names can change.
Verify the interface names match the desired interfaces after modifying
or deleting PVCs.
The rules are stored on the IAD in the file, filter.st, and can be viewed
through the user interface. You may edit the filter.st file external to the IAD
and then download it to the IAD.
Grammar
The format used for construction of filtering rules can be described using the
following grammar in BNF:
filter-rule = action in-out [ options ] [ match ] [ keep ]
action = “block” | "pass" | “count”
in-out = "in" | "out"
options = [ "quick" ] [ "on" interface-name ]
match = [ tos ] [ ttl ] [ proto ] [ ip ]
keep = "keep state"
tos = "tos" decnumber | "tos" hexnumber
ttl = "ttl" decnumber
proto = "proto" protocol
ip = srcdst [ flags ] [ with withopt ] [ icmp ] [ keep ]
protocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber
srcdst = "all" | fromto
fromto = "from" object "to" object
object = [“!”] addr [ port-comp | port-range ]
addr = "any" | nummask | host-name [ "mask" ipaddr | "mask" hexnumber ]
port-comp = "port" compare port-num
port-range = "port" port-num range port-num
flags = "flags" flag { flag } [ "/" flag { flag } ]
with = "with" | "and"
icmp = "icmp-type" icmp-type [ "code" decnumber ]
nummask = host-name [ "/" decnumber ]
host-num = digit [ digit [ digit ] ]
port-num = service-name
| decnumber
withopt = [ "not" | "no" ] opttype [ withopt ] .