
IPv4 Rules:
1: pass on interface lo0 all hits: 0 bytes: 0
2: pass on interface wm1 hits: 227 bytes: 7025
From To
192.168.211.0/24 -> 192.168.211.0/24
3: block all hits: 26 bytes: 2579
IPv6 Rules:
1: pass on interface lo0 all hits: 0 bytes: 0
2: pass hits: 0 bytes: 0
From To
fe80::/10 -> any
3: block all hits: 0 bytes: 0
The new rule shows that packets from network internal:net are allowed into the system if they are being sent to the
same network. Without this rule, the newly added IP address could not be reached from the rest of the network.
Also note that IPv4/6 rule 1 allows Equalizer traffic if it is on the localhost interface (lo0), and IPv4/6 rule 3 blocks
all traffic which didn't fall into one of the previous rules. This is the
default deny
rule. IPv6 rule 2 is an
automatically-added rule for link-local IPv6 addresses, which is always there if any networks are configured.
If all of the clients and servers for this Equalizer are on the internal:net network, we're done, however, most
installations have customers which are on a different network, usually the Internet.
Single VLAN/Subnet with a Default Gateway
We can connect the system to the Internet by adding a default route (the newly-added rules are in
italics
) because
there is only a single Equalizer local network,
eqcli > vlan internal subnet net default_route 192.168.211.1 eqcli: 12000287:
Operation successful
Source Routing Table:
192.168.211.0/24:
default via 192.168.211.1
Copyright © 2013 Coyote Point Systems. A subsidiary of Fortinet, Inc.
All Rights Reserved.
83
Equalizer Administration Guide
Comentarios a estos manuales