Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

IP Filter rule
basics
Chapter 4: Understanding Policy Configuration
IP Filter rule basics
IP Filter rules allow you to securely forward IP packets between networks,
allowing traffic to pass between the networks (for example, encrypted VPN
sessions). You can create IP Filter rules for TCP, UDP, ICMP, and many other
protocols (such as AH).
Security Alert: Secure Computing strongly recommends that you use IP Filter only
for non-TCP/UDP protocols, such as Vines, PPTP, NES, etc. Using IP Filter for a
TCP/UDP protocol will, in most cases, severely degrade the effectiveness of the
Sidewinder G2 and will expose your network to security hazards.
Functionally, IP Filter is based upon a rule database in the Sidewinder G2
kernel. IP Filter rules filter incoming packets based on source IP address,
destination IP address, and ports. Like proxy rules, IP Filter rules also have the
option of using network address translation (NAT) and/or redirection. You can
configure and manage the IP Filter rule database using the Admin Console.
IP Filter processing can be configured to reject the following source address
packets:
• Packets with broadcast source addresses
• Packets with source addresses on a loopback network that were received
on a non-loopback device
Note: Packets that are rejected for source route information will generate a
netprobe audit event.
When you initially configure the Sidewinder G2, you will have a default IP Filter
rule group that is assigned in the active rules. This rule group is empty. You can
create and add rules and/or rule groups to this group, or create your own group
and assign it as the active rule group instead.
The following sections summarize how IP Filtering works when stateful packet
inspection (also known as session tracking) is enabled and when it is not
enabled. The sections also provide information on what criteria is used to
determine rule matches and what happens after the Sidewinder G2 checks the
packet against the active IP Filter rules.
Note: For information on creating IP Filter rules, see “Creating IP Filter rules” on
page 228.
121