Black Box ACS120 Guida Utente Pagina 164

  • Scaricare
  • Aggiungi ai miei manuali
  • Stampa
Vedere la pagina 163
Filters and Network Address Translation
164 BLACK BOX ® Advanced Console Server
Target Extensions
Iptables can use extended target modules. The following are included in the standard
distribution.
LOG
Turn on kernel logging of matching packets. When this option is set for a rule, the Linux
kernel will print some information on all matching packets (like most IP header fields) via the
kernel log (where it can be read with syslog-ng).
REJECT (filter table only)
This is used to send back an error packet in response to the matched packet: otherwise it is
equivalent to DROP. This target is only valid in the INPUT, FORWARD and OUTPUT chains,
and user-defined chains which are only called from those chains. Several options control the
nature of the error packet returned:
SNAT (nat table only)
This target is only valid in the nat table, in the POSTROUTING chain. It specifies that the
source address of the packet should be modified (and all future packets in this connection
will also be mangled), and rules should cease being examined. It takes one option:
- -source-port [port[,port]] Match if the source port is one of the given ports.
- -destination-port [port[,port]] Match if the destination port is one of the given ports.
- -port [port[,port]] Match if the both the source and destination port are
equal to each other and to one of the given ports.
- -log-level level Level of logging (numeric or see syslog.conf(5)).
- -log-prefix prefix Prefix log messages with the specified prefix; up to 29 letters
long, and useful for distinguishing messages in the logs.
- -log-tcp-sequence Log TCP sequence numbers. This is a security risk if the log is
readable by users.
- -log-tcp-options Log options from the TCP packet header.
- -log-ip-options Log options from the IP packet header.
Vedere la pagina 163
1 2 ... 159 160 161 162 163 164 165 166 167 168 169 ... 449 450

Commenti su questo manuale

Nessun commento