Top Menu

Here you have links to:

1. Insert: new rules in advanced mode
2. Delete: already inserted rules
3. Order: Interface to order all the rules that exist in the firewall (Figure 5.9). This option is particularly important when new rules are created. Because the first rules thet firewall does the matching will be the first to use. Then, more specific rules should be at the top and gneral should be at the bottom.

You can insert three types of rules:

• DNAT Rule: Redirects the traffic that comes to a port to another port/machine of the internal network;
• IP machine Restrition: It defines the denial of access to a port of defined network machine;
• General Configuration: Here you can add a completaly personalized rule. These are the affected fields:
  • Rule:

    INPUT: Data received by the firewall that aim the recipient interface
           no matter their origin;
    OUTPUT: Data sent by the firewall;
    FORWARD: Redirects traffic from an interface to another;
    PREROUTING: Is used to change IP packets arriving to the machine 
                before the routing decision;
    POSTROUTING: Is used to change IP packets arriving to the machine
                 after the routing decision;
    

  • Interface: You should choose which interface to apply the rule;
  • Protocol: Protocol(s) to which you want to apply the rule;
  • Modul: Shows the list of iptables modems available for use;
  • Source Ip: Source IP Address of the packet;
  • Origin port: Source port of the packet;
  • Destination IP: Destination IP address of the packet;
  • Destination port: Destination port of the packet;
  • Identifier: 16 bits field that exists in the original IP packet - it is used to identify the type of packet to filter. Examples: ! -syn, --state INVALID;
  • Politics:

    ACCEPT: To accept a packet and let it pass the firewall rules;
    DELETE: Doesn't accept the packet and eliminates it;
    MARK: Saves a mark in the packet. These marks can be used to make
          decisions at the forwarding level;
    LOG: Saves a log of every packet that folows the rule.
    

  • If the PREROUTING rule is used, there are the following extra policies:

    REDIRECT: Used to redirect the traffic arriving from a port to 
              another port;
    DNAT: it allows to redirect the traffic arriving at a certain 
          port to another machine and port belonging to the internal
          network
    

  • If the POSTROUTING rule is used, there are the following extra policies:

    MASQUERADE: It allows to 'mask' the traffic 
    SNAT: It allows to redirect the traffic generated in a certain
          port to another machine and port.
    TCPMSS: It changes the MSS field (maximum packet size) from the
            TCP header. It just can be used to TCP SYN or SYN/ACK 
            packets because is just used in the beginning of conections.
    

  The rules that are defined by default can't be eliminated, but can be deactivated by clicking in the state of the rule and change the Deactivate option.

Figure 5.8: Network - Firewall - Insert

Figure 5.9: Network - Firewall - Order