IP filtering

IP filtering allows you to manage rules for filtering IP packets entering and leaving the appliance through its management interfaces. IP filtering supports IPv4 and IPv6, by separate but largely identical sets of CLI commands. For more information, see the CLI Command Reference.

IP filtering is disabled by default for both IPv4 and IPv6. However, some appliances may have IP filtering enabled by existing components on the system which will still be visible in the show ip filter command output.

Note

Enabling IPv6 filtering has no effect unless IPv6 is enabled.

Interfaces supported by IP filtering rules

When you use IP filtering, interfaces can be grouped into three sets:

If a rule does not specify an interface, the default is "ether+," which in IP filtering matches any interface beginning with "ether".

Viewing IP filtering rules

When you view a list of IP filtering rules using the show ip filter or show ipv6 filter command, rules added for management interfaces as described above and rules added automatically by the system are listed together, in the order in which they are applied.

If you are on the VPN, you should use the show ipv6 filter command, which displays detailed information about the firewall rules. The show ipv6 filter configured command, described below, does not include this information.

Rules that are manually configured are shown with numbers in the left column, which correspond to the rule numbers visible in show ip filter configured and show ipv6 filter configured command output. Rules that are added automatically by the system do not have numbers.

The default filter configuration for the INPUT and OUTPUT chains is an ACCEPT rule with a DROP policy for all traffic on all interfaces whose names begin with "ether". The default configuration for the FORWARD is simply a DROP policy with no rules since Intelligent Virtual Execution - Server appliances do not forward packets. Enabling IP filtering has no effect on your network's function until you create new IP filter rules.

When IP filtering is enabled, one additional rule is added automatically by the system after all configured rules. This rule is to ACCEPT all inbound and outbound traffic on the loopback 'lo' interface. The system requires the loopback interface to work for internal purposes.

Note

When you enable Managed Defense, IP filters are automatically enabled. See the Managed Defense Quick Start Guide for details.

Caution

This feature will affect integration with third-party services. Exercise caution and common sense when adding IP filtering rules. If rules are set improperly, it may cause problems such as dropping all traffic. For example, adding DROP rules on the OUTPUT chain for ether1 or ether+ could interfere with remote syslog; or adding DROP rules on the INPUT chain could interfere with external access to system services such as SNMP.