Avocent MERGEPOINT 53XX SP MANAGER User's Guide download pdf (Page 37)

To delete a private subnet:

1. Click Network - Private subnet.

2. Check the private subnet you want to delete and click Delete.

Firewall/Packet Filtering

Packet filtering on the MergePoint SP manager is controlled by chains and rules that are

configured in iptables. By default, the MergePoint SP manager does not forward any traffic

between private and public networks. Rules can be added to allow limited communications

between specific SPs on the private network and the public network.

NOTE: It is possible for an Admin user to create rules that circumvent the access controls on an SP.

Chains

A chain is a type of named profile that defines rules for sorting packets.

The MergePoint SP manager has a number of built-in chains with hidden rules that are

preconfigured to control communications between SPs connected to the private Ethernet ports

and devices on the public side of the MergePoint SP manager.

The default chains are defined in filter and NAT (network address translation) iptables. The

mangle table is not used. The built-in chains are named according to the type of packets they

handle. The first three chains, INPUT, OUTPUT and FORWARD are in the iptables filter table.

PREROUTING, POSTROUTING and OUTPUT are in the NAT table and implement NAT.

This includes redirecting packets addressed to a virtual IP to the SP's real IP address and then

hiding the SP's real IP address when the SP sends packets to a user.

Rules

Each chain can have one or more rules that define the following:

• The packet characteristics being filtered. The packet is checked for characteristics defined

in the rule, for example, a specific IP header, input and output interfaces and protocol.

• What action is performed when the packet characteristics match the rule. The packet is

handled according to the specified action (called a Rule Target, Target Action or Policy).

Rules are listed in order of priority. You can change the rule order by clicking the arrow on the

rule line. The arrow appears when there are at least two rules in a list.

When a packet is filtered, its characteristics are compared against each rule in the list until a

match is found. Once a match is found, the packet is processed and no attempt is made to

match lower priority rules.

Chapter 2: Installation and Setup 25

1 2 ... 32 33 34 35 36 37 38 39 40 41 42 ... 235 236

No comments

Avocent MERGEPOINT 53XX SP MANAGER User's Guide Page 37