Black Box ACS120 Uživatelská příručka stáhnout pdf (Strana 160)

Filters and Network Address Translation

160 BLACK BOX ® Advanced Console Server

Rule Specification Options

The following additional options can be specified:

-p - -protocol[!]protocol

The protocol of the rule or of the packet to check. The specified protocol can be

one of tcp, udp, icmp, or all, or it can be a numeric value, representing one of

these protocols or a different one. A protocol name from /etc/protocols is also

allowed. A "!" argument before the protocol inverts the test. The number zero is

equivalent to all. Protocol all will match with all protocols and is taken as default

when this option is omitted.

-s - -source[!]address[/mask]

Source specification. Address can be either a hostname, a network name, or a

plain IP address. The mask can be either a network mask or a plain number, speci-

fying the number of 1's at the left side of the network mask. Thus, a mask of 24 is

equivalent to 255.255.255.0. A "!" argument before the address specification

inverts the sense of the address. The flag - -src is a convenient alias for this option.

-d - -destination[!]address[/mask]

Destination specification. See the description of the -s (source) flag for a detailed

description of the syntax. The flag - -dst is an alias for this option.

-j - - jump target

This specifies the target of the rule; i.e., what to do if the packet matches it. The

target can be a user-defined chain (other than the one this rule is in), one of the

special built-in targets which decide the fate of the packet immediately, or an

extension (see EXTENSIONS below). If this option is omitted in a rule, then match-

ing the rule will have no effect on the packet's fate, but the counters on the rule

will be incremented. The special built-in targets are :

• ACCEPT means to let the packet through.

• DROP means to drop the packet on the floor.

• QUEUE means to pass the packet to userspace (if supported by the kernel).

• RETURN means stop traversing this chain and resume at the next rule in the

previous (calling) chain. If the end of a built-in chain is reached or a rule in a

built-in chain with target RETURN is matched, the target specified by the

chain policy determines the fate of the packet.

1 2 ... 155 156 157 158 159 160 161 162 163 164 165 ... 449 450

Žádné komentáře

Black Box ACS120 Uživatelská příručka Strana 160