Download RAS 2000 PowerRack Software Configuration Guide

Table 10-5: IP
Keyword
Parameters
Filtering Tests (Continued)
Definition
Comments
This matches any TCP packet that has the SYN flag set. This flag is
always set in the first packet sent over a TCP connection, so this test
could be included in a rule to prevent certain new TCP connections
from being started up.
syn
port
port number
The destination port in the IP
header must match this one.
ports
range
The destination port in the IP
header must match this range.
(e.g. 1-35)
ports reserved
The destination port in the IP
header must be one of the well
known reserved ports 1-1023.
Since we are talking about network
headers, port refers to the TCP or
UDP service port associated with a
connection; it has nothing to do
with serial ports.
When you use the port keyword,
you must also specify either TCP
or UDP, since the same port numbers could apply to either.
Sample Rules
Here are some sample rules. See if you can figure out what they are supposed to
do.
allow in dst 160.77.99.30 tcp port 21
This rule allows all incoming packets destined for port 21 (used for FTP connections) of
host 160.77.99.30. Specifically, this allows an outsider to establish an FTP connection to
one particular host.
deny in tcp reserved
This rule denies all incoming packets addressed to any well-known port of any host. This
rule prevents an outsider from starting a TCP connection to any of the standard network
services, except for ones specifically permitted by earlier rules in the filter.
RAS 2000 Software Configuration Guide
Page 245