This document describes Packet Filter (PF) feature of SafeFire PPP.
Following explanation assumes some knowledge of the basic principles of TCP/IP networking, i.e. what is an IP address, what is an IP protocol (service) and what is a TCP/UDP port number. Also, general understanding what is an IP packet and what is a packet header is required.
The packet filter is one of the main facilities for protection of an internal network from illegal access.
The main idea of the packet filter is quite simple. Each packet, which is going through PF has some specific information located in a packet header. PF compares this information with so called 'rules' contained in special database. Each rule contains set of matching parameters and declares an action (permit or deny). When an exact match is found the declered action is performed.
Set of matching parameters can include:
SafeFire PPP package contains several sample configurations. Different configurations may use up to three packet filters. Each filter is configured independently through appropriate section in configuration file.
Each section consists of the following variables:
This variable enables PF. By default PF is OFF. To enable it, set value of this variable to either 'on', '1' or 'true'.
Because by default packet filter rejects all packets this is necessary to allow packets for particular service go through PF to/from protected net, two rules should be defined. One rule should cover outgoing packets with source in internal net while other should cover incoming packets with destination in the internal net.
For example, following two rules will allow a connection to external SMTP servers (an internal net is assumed 192.168.xx.xx in this sample):
allow tcp from 192.168.0.0:255.255.0.0 to any smtp out allow tcp from any smtp to 192.168.0.0:255.255.0.0
NOTE:
A port range for an internal net side is not specified, because an outgoing connection can have any port number and it is maintained by the OS/2 TCP/IP stack.
Each rule has a number which is an identifier for add/remove operations. The order in which rules will be checked out also defined by this number. The rule with smaller number will be checked first. You can assign numbers manually or let a system assign numbers automatically.
If you do not assign numbers manually, all rules will be added in order which they are defined in configuration file or otherwise added.
Each occurrence of 'rule' variable in configuration file defines one rule as in example below:
[filter] enable = on rule = allow ip from 10.0.2/24 to any out rule = allow ip from any to 10.0.2/24 in
Each rule has the following syntax:
[<number>] action [log] protocol source destination [extra[,...]]
where
optional rule number
allow accept permit | - | allow a packet to go through the packet filter |
deny drop | - | drop packet |
reject | - | drop packet and send ICMP UNREACH to the sender |
count | - | count packet matching rule and go to the next rule |
optional flag that tells packet filter to print some information about matching packet to the SYSLOG facility.
ip, all | - | rule is for all types of protocols |
tcp | - | rule is for TCP packets only |
udp | - | rule is for UDP packets only |
icmp | - | rule is for ICMP packets only |
source and destination clauses use similar syntax:
keyword [not] addrdef portdef
from | for the source clause |
to | for the destination clause |
reverses meaning of source mask, i.e. rule will be applied if packet has origin NOT falling to address/mask specified in this rule
defines address or range of addresses of the packet
addrdef has the following syntax:
{any|ip[{/bits|:mask}]}
where
any | - | packet can have any origin |
ip/bits ip:mask | - | these are two forms of description of source IP address and mask |
ip | - | is IP address written in usual dot delimited form |
bits | - | specifies number of high bits in address which will be used for comparison |
mask | - | specifies a mask with which should be done logical AND operation before comparison |
defines a port or a set of ports which will be used for comparison
portdef has the following syntax:
[{port|port-port},[port],...]
where
port[,port] port-port | - |
these are two forms of the specifying a source or destination
port of a packet. First form can be used to specify up to 10 separate ports. Second form specifies inclusive range of ports. |
port | - | can be either a port number or a service name as described in the SERVICES file from the directory pointed by a ETC environment variable. |
extra is one of following:
fragment | - | if this flag is specified then rule will be
applied only to fragments of the packets
NOTE: may not be used with ports or tcpflags (see below) |
in | - | match only incoming packets |
out | - | match only outgoing packets |
established | - | match packets belongs to established TCP connection |
setup | - | match packets belongs to TCP packets used as connection setup stage |
tcpflags [!]{syn|fin|rst|ack|psh|urg},... | - | matching TCP packet should have specified bits set (reset if '!' is present) |
Return to documentation index | SafeFire PPP (C) Link Guard Solutions 1999 |