
To view the current IP Filter rules, the show sbr command can once again be used. The example below is
shortened due to its length.
IP Filter Rules:
IPv4 Rules:
1: pass on interface lo0 all hits: 287 bytes: 14900
2: pass on interface wm1 hits: 11394 bytes: 326068
From To
192.168.211.0/24 192.168.211.0/24
192.168.105.0/24 -> 192.168.105.0/24
10.0.0.0/24
0.0.0.0/0
3: pass on interface wm0 hits: 120406 bytes: 7689819
From To
10.0.0.0/24 10.0.0.0/24
0.0.0.0/0 -> 0.0.0.0/0
192.168.211.0/24
192.168.105.0/24
4: block on interface wm1 hits: 0 bytes: 0
From To
192.168.211.0/24 192.168.211.0/24
-> 192.168.105.0/24
10.0.0.0/24
0.0.0.0/0
The example above shows each filter rule, along with the groups of networks that the rule applies to, and the
number of times each rule has been used (and bytes that have been received using this rule).
Each column of From and To addresses can be viewed as an "or" group. For example, rule #3 can be read as:
“Allow traffic on interface wm0 which is from either the 10.0.0.0/24 network or the 0.0.0.0/0 network, and is
destined for either the 10.0.0.0/24, the 0.0.0.0/0, the 192.168.211.0/24, or the 192.168.105.0/24 network.”
Rules are processed (and must be read) in order, from first to last. This means that as soon as a packet matches a
particular rule it is used and Equalizer either passes or allows that packet, depending on the rule.
The individual rules are somewhat complicated and will be explained in "Network Configuration" on page 77
To summarize, rules are processed in numerical order by the packet filter.
Pass
rules cause packets to be allowed
into the system and
block
rules are ones that explicitly block traffic from entering the system. The last rule is
block
in all
which means that if a
pass
rule has not yet matched this particular packet, it will be dropped.
Copyright © 2013 Coyote Point Systems. A subsidiary of Fortinet, Inc.
All Rights Reserved.
125
Equalizer Administration Guide
Comentarios a estos manuales