 |
FirewallBuilder |
|
Search Users Guide
The regular address object describes single a IPv4 address. It can be a child of an interface object, in which case it represents an IP address and netmask of the interface, or it can be used as a standalone object. In the latter case it does not have a netmask and is located in the Objects/Addresses branch of the objects tree.
In this case the object is a "child" or "leaf" under the an interface object, either on a host or a firewall object. To create this kind of an address, right-click the interface object to bring up the context menu.
Its dialog provides the following entry fields:
-
Name
This is the name of the object. Use a descriptive name because when the address object is used in the firewall policy, it is labeled with this name. It may be hard to tell one address from another if their names are similar.
-
Address
This is an IP address. The GUI widget provides syntax control for the values entered in the field. (This syntax control activates when you save the object.)
Note
A typical error is to interpret this object as an address of the subnet to which the interface of the host or firewall belongs. This object represents an address of the interface, not a network address. (So, 192.168.1.1, not 192.168.1.0)
-
Netmask
This is a netmask assigned to the interface. You can enter the netmask using the traditional method (255.255.255.0) or using network bit length notation ("24"). Bit length notation is converted to a traditional netmask by Firewall Builder.
-
DNS Lookup
If the host object has the same name as the actual machine, then clicking this button generates a DNS query that populates the interface IP address and subnet. Only the parent host or firewall object's name is used for the DNS query; the name of the interface is ignored and can be anything.
-
Comment
This is free-form text field for a comment.
Here we use our IPv4 address in a rule (remember, it belongs to the interface):
Firewall Builder's iptables compiler, for example, generates the following command from this rule:
$IPTABLES -A INPUT -p tcp -m tcp -d 172.16.22.1 --dport 22 -m state \ --state NEW -j ACCEPT
Note how even though the address object has a netmask, the generated command matches the address as a host address, not as a subnet. This is because the netmask is used only to describe the subnet for the interface, not to describe the subnet. When this address object is used in a rule, it is understood that the intention is to match the address of the interface it belongs to rather than any address on the subnet. Use the network object if you need to match a whole subnet.
This iptables rule was placed in the INPUT chain because the object in the "Destination" was an address of an interface of the firewall. While processing the policy for the iptables target firewall platform, Firewall Builder compares addresses in the source and destination of a rule to the addresses of all interfaces of the firewall to find rules that control access to and from the firewall. Firewall Builder places these rules into INPUT or OUTPUT chains. This is only necessary for iptables.
In this case the object is located in the part of the objects tree and does not have a netmask entry field. To create this kind of an address, use the menu to select or use the right-click menu associated with the addresses folder in the tree.
Dialog fields Name, Address and Comment have the same purpose and properties as an address object assigned to an interface object.
The DNS Lookup button can be used to automatically populate the address field using a DNS query. The program runs DNS query for the "A" record with the name of the address object. The object name does not have to match any DNS record if you never plan to use this feature. DNS query function is just a convenience, but to use it, the name of the object must match a DNS record.
Copyright © 2000-2012 NetCitadel, Inc. All rights reserved.
Using free CSS Templates.