The command ip filter chain is also applicable as ipv6 filter chain.
Use [no] ip filter chain [chain] policy [policy] to set the policy for a specified chain, or reset to its default. All of the rules on this chain will override the default. The only chains allowed are INPUT, OUTPUT, and FORWARD; and the only targets allowed are ACCEPT and DROP.
The default policies for each chain are:
OUTPUT: ACCEPT
INPUT: DROP
FORWARD: DROP
Use [no] ip filter chain [chain] {pre-rules | post rules} [pre-defined ruleset] to choose a pre-defined set of rules to always come before (pre-rules) or after (post-rules) the configured rules for the specified chain. The only pre-defined ruleset available is called ALLOW_RELATED, which permits any packets which pertain to an established connection or which are related to an established connection. Normally this is used on the INPUT chain, with a default policy of DROP on INPUT, to permit incoming packets which are simply responses to something initiated on OUTPUT.
You can also specify "none" for the ruleset, which means to use no addition rules at this position. The "no" variant does the same thing as specifying "none".
You can add a filtering rule to the specified chain (in the "filter" table), overwrite an existing rule, or delete an existing rule.
Example:
ip filter chain <chain> \
rule {append tail | insert <rule number> | \set <rule number> | modify <rule number> | \
delete matching} \
target <target> \
\
[comment <comment string>] \
[dup-delete] \
\
[source-addr <IPv4 prefix> <IPv4 netmask>] \
[dest-addr <IPv4 prefix> <IPv4 netmask>] \
[in-intf <intf name>] \
[out-intf <intf name>] \
[protocol <protocol>] \
[source-port <port or port range>] \
[dest-port <port or port range>] \
[state <state(s)> \
\
[not-source-addr <IPv4 prefix> <IPv4 netmask>] \
[not-dest-addr <IPv4 prefix> <IPv4 netmask>] \
[not-in-intf <intf name>] \
[not-out-intf <intf name>] \
[not-protocol <protocol>] \
[not-source-port <port or port range>] \
[not-dest-port <port or port range>]
The other variants add or modify a rule. The position of the rule is determined by the two arguments after the word "rule":
"append tail" means to add a new rule after all existing rules.
"insert <rule number>" means to insert a new rule before the existing rule with the specified number; the number specified must be that of an existing rule. The rule specified and all above it will be renumbered to make room for the new rule.
"set <rule number>" specifies the rule number of an existing rule to overwrite with the new rule. No attempt is made to merge the old rule and new; the old one is obliterated.
"modify <rule number>" specifies the rule number of an existing rule to modify. Only the parameters specified in this invocation are changed; everything else is left untouched, except that setting a criterion removes any corresponding "not-" criterion, and vice-versa.
Tip
Rule numbers will always be contiguous. There is no provision for leaving spaces between numbers, nor should this be necessary, due to the ease of insertion and deletion.
All of the arguments after the target are optional. The following conditions apply:
There must always be at least one rule.
Each of the "not-..." arguments is mutually exclusive with the corresponding positive argument.
If a given kind of restriction is not specified, there is assumed to be no restriction for that type of criteria.
All criteria specified are ANDed together. There is no way to specify for criteria to be ORed within a single rule; rather, you would need to have multiple rules with the same target.
The 'comment' argument specifies a user-visible comment to be kept with the rule. This does not affect the operation of the rule. The 'dup-delete' argument specifies that after adding or modifying
the rule, we should delete all other pre-existing rules which are duplicates of it. By default, there is no duplicate detection, and creation of duplicates is freely permitted.
An <IPv4 netmask> may be given either as a netmask (e.g. 255.255.255.0); or as a mask length preceded by a forward slash (e.g. /24).
A single inbound interface name may be specified with in-intf; and/or a single outbound interface name may be specified with out-intf. You can also use "+" to do a prefix match, e.g. "ether+" will match all interfaces whose names start with "ether". If no interface name is specified, "ether+" is the default.
Tip
Only interfaces beginning with "ether" are permitted to be specified in user-configured rules.
The available protocols are tcp, udp, icmp, and all. If you do not specify a protocol, "protocol all" is the default. If you specify "not-protocol all" it will not match anything. If tcp or udp are selected for the protocol, you may specify source and/or destination ports. If icmp is selected, these options will either be ignored, or produce an error.
The source or destination port may each be either a single number, or a range specified as "<low>-<high>", e.g. "10-20" would specify ports 10 through 20, inclusive. Only one port or port range may be specified (per type, i.e. one for source, and/or one for destination).
The "state" criteria has to do with the classification of the packet relative to existing connections. A packet can be in one of three states:
* ESTABLISHED, meaning it is associated with an existing connection which has seen traffic in both directions.
* RELATED, meaning it opens a new connection, but one which is related to an established connection.
* NEW, meaning it opens a new, unrelated connection.
The <state(s)> parameter contains one or more of these state words. If there are more than one, they should be separated by commas, e.g. "ESTABLISHED,RELATED".
Syntax
ip filter chain [chain] policy [policy]
[no] ip filter chain [chain] policy
ip filter chain [chain] clear
[no] ip filter chain [chain] rule [rule number]
ip filter chain [chain] rule move [old number] to [new number]
ip filter chain [chain] pre-rules [pre-defined ruleset]
ip filter chain [chain] post-rules [pre-defined ruleset]
[no] ip filter chain [chain] pre-rules
[no] ip filter chain [chain] post-rules>
Parameters
| Disables the feature or delete an existing item of iptables configuration. If you specify a chain and rule, just that rule is deleted and higher-numbered rules will be renumbered to close the gap. If you specify just a chain, all rules in that chain are deleted, and the chain's policy and baseline are reset to their defaults. |
| Sets the IP filter chain. |
| Sets the IP filter police. |
| Sets the IP filter rule number. |
| Moves an existing filtering rule to a different position within the same chain. It is inserted at the new location, and removed from the old location, and surrounding rules are renumbered to keep the numbers consecutive. |
|
Example
The following example enables IP filtering a Trellix appliance.
hostname (config) # ip filter chain
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Central Management System: Release 7.5.0
Endpoint Security (HX): Release 2.5
Network Security: Release 7.5.0