Next Previous Contents

3. New Rule Dialog

Here you describe the pattern for which the rule will apply and the action that takes effect if the rule matches a packet.

The SrcDev and DstDev comboboxes let you specify a device. The DstDev will only work, if the packet will be forwarded. You can also choose "*", if the device doesn't matter.

The SrcIP and DstIP comboboxes take a CIDR IP address, which is in the format xxx.xxx.xxx.xxx/yyy. Where xxx.xxx.xxx.xxx is an IP network address and yy specify the amount of valid bits from the left. E.g. 127.0.0.1/8 means all IPs with 127. in the beginning, 192.168.1.1/32 means the exact IP address 192.168.1.1. You can also choose "*", if the IP doesn't matter.

The SrcPorts and DstPorts take a port or a port range in the format port[:port]. E.g. 1:80 means all ports from 1 to 80. You can also choose "*", if the port doesn't matter. If you selected the ICMP protocol, the destination port is equal to the icmp type of the packet. Instead of a number (e.g. 80) you can also specify the service name (www), found in /etc/services.

The Proto combo lets you choose a protocol which the packet must fit to apply to the rule. E.g. TCP, UDP or ICMP or * for all protocols.

In the Action combobox you can choose between:

ACCEPT

means that the packet will take its normal way through the network layer to an application or to an other host.

DENY

means the packet will be ignored without notification to the sender.

REJECT

means the packet will be ignored and an ICMP message is sent to the sender telling it that the packet was rejected.

REDIRECT

will redirect the packet to a local port instead of the destination address.

In the RedirPort input field, you choose a port to which the packet is redirected (transparent proxy), if the action is REDIRECT.

If you check Log appearance, then a log entry appears in /var/log/messages, if the rule takes effect.

If you check Bidirectional, then the rule will also fit a packet with source and destination parameters swapped.

If you check Start of connection, then the rule will only fit the start of a TCP connection. Hint: Choose protocol TCP and action ACCEPT first.

If you check Only connected, then the rule will only fit an already established TCP connection. Hint: Choose protocol TCP first and action DENY or REJECT first.


Next Previous Contents