From 5ce3679ff3d42cf499849826ded3585649c91656 Mon Sep 17 00:00:00 2001 From: Nicolas Fort Date: Thu, 8 Sep 2022 13:23:42 -0300 Subject: Update policy route docs. Gral structure change, moving forward to a similar structure that firewall docs. Also, new matching options was added to the docs. --- docs/configuration/policy/route.rst | 425 +++++++++++------------------------- 1 file changed, 126 insertions(+), 299 deletions(-) (limited to 'docs/configuration/policy') diff --git a/docs/configuration/policy/route.rst b/docs/configuration/policy/route.rst index 0aa43232..6f60bc36 100644 --- a/docs/configuration/policy/route.rst +++ b/docs/configuration/policy/route.rst @@ -1,43 +1,59 @@ -############ -Route Policy -############ +####################### +Route and Route6 Policy +####################### -Route and IPv6 route policies are defined in this section. This route policies -can then be associated to interfaces. +IPv4 route and IPv6 route policies are defined in this section. These route +policies can then be associated to interfaces. -************* -Configuration -************* +********* +Rule-Sets +********* -Route -===== - -.. cfgcmd:: set policy route - - This command creates a new route policy, identified by . +A rule-set is a named collection of rules that can be applied to an interface. +Each rule is numbered, has an action to apply if the rule is matched, and the +ability to specify the criteria to match. Data packets go through the rules +from 1 - 999999, at the first match the action of the rule will be executed. .. cfgcmd:: set policy route description +.. cfgcmd:: set policy route6 description - Set description for the route policy. + Provide a rule-set description. .. cfgcmd:: set policy route enable-default-log +.. cfgcmd:: set policy route6 enable-default-log Option to log packets hitting default-action. .. cfgcmd:: set policy route rule description +.. cfgcmd:: set policy route6 rule description - Set description for rule in route policy. + Provide a description for each rule. -.. cfgcmd:: set policy route rule action drop +.. cfgcmd:: set policy route rule log +.. cfgcmd:: set policy route6 rule log - Set rule action to drop. + Option to enable or disable log matching rule. + +Matching criteria +================= +There are a lot of matching criteria options available, both for +``policy route`` and ``policy route6``. These options are listed +in this section. + +.. cfgcmd:: set policy route rule source address + .. cfgcmd:: set policy route rule destination address +.. cfgcmd:: set policy route6 rule source address + +.. cfgcmd:: set policy route6 rule destination address + - Set match criteria based on destination address, where - could be: + Set match criteria based on source or destination ipv4|ipv6 address, where + could be: +For ipv4: * : IP address to match. * : Subnet to match. * -: IP range to match. @@ -45,14 +61,30 @@ Route * !: Match everything except the specified subnet. * !-: Match everything except the specified range. +And for ipv6: + * : IPv6 address to match. + * : IPv6 prefix to match. + * -: IPv6 range to match. + * !: Match everything except the specified address. + * !: Match everything except the specified prefix. + * !-: Match everything except the + specified range. + +.. cfgcmd:: set policy route rule source group + .. cfgcmd:: set policy route rule destination group - + +.. cfgcmd:: set policy route6 rule source group + +.. cfgcmd:: set policy route6 rule destination group + - Set destination match criteria based on groups, where would be the - group name/identifier. + Set match criteria based on source or destination groups, where + would be the group name/identifier. Prepend character '!' for inverted + matching criteria. -.. cfgcmd:: set policy route rule destination port - +.. cfgcmd:: set policy route rule destination port +.. cfgcmd:: set policy route6 rule destination port Set match criteria based on destination port, where could be: @@ -66,24 +98,43 @@ Route '!22,telnet,http,123,1001-1005' .. cfgcmd:: set policy route rule disable +.. cfgcmd:: set policy route6 rule disable Option to disable rule. +.. cfgcmd:: set policy route rule dscp +.. cfgcmd:: set policy route6 rule dscp +.. cfgcmd:: set policy route rule dscp-exclude +.. cfgcmd:: set policy route6 rule dscp-exclude + + Match based on dscp value criteria. Multiple values from 0 to 63 + and ranges are supported. + .. cfgcmd:: set policy route rule fragment +.. cfgcmd:: set policy route6 rule fragment + Set IP fragment match, where: * match-frag: Second and further fragments of fragmented packets. * match-non-frag: Head fragments or unfragmented packets. -.. cfgcmd:: set policy route rule icmp +.. cfgcmd:: set policy route rule icmp +.. cfgcmd:: set policy route6 rule icmpv6 + + Match based on icmp|icmpv6 code and type. + +.. cfgcmd:: set policy route rule icmp type-name +.. cfgcmd:: set policy route6 rule icmpv6 type-name - Set ICMP match criterias, based on code and/or types. Types could be - referenced by number or by name. + Match based on icmp|icmpv6 type-name criteria. Use tab for information + about what type-name criteria are supported. .. cfgcmd:: set policy route rule ipsec +.. cfgcmd:: set policy route6 rule ipsec + Set IPSec inbound match criterias, where: @@ -91,88 +142,45 @@ Route * match-none: match inbound non-IPsec packets. .. cfgcmd:: set policy route rule limit burst <0-4294967295> +.. cfgcmd:: set policy route6 rule limit burst <0-4294967295> - Set maximum number of packets to alow in excess of rate + Set maximum number of packets to alow in excess of rate. .. cfgcmd:: set policy route rule limit rate +.. cfgcmd:: set policy route6 rule limit rate Set maximum average matching rate. Format for rate: integer/time_unit, where time_unit could be any one of second, minute, hour or day.For example 1/second implies rule to be matched at an average of once per second. -.. cfgcmd:: set policy route rule log - - Option to enable or disable log matching rule. - -.. cfgcmd:: set policy route rule log - - Option to log matching rule. - .. cfgcmd:: set policy route rule protocol - + +.. cfgcmd:: set policy route6 rule protocol + - Set protocol to match. Protocol name in /etc/protocols or protocol number, - or "tcp_udp" or "all". Also, protocol could be denied by using !. + Match a protocol criteria. A protocol number or a name which is defined in: + ``/etc/protocols``. Special names are ``all`` for all protocols and + ``tcp_udp`` for tcp and udp based packets. The ``!`` negates the selected + protocol. -.. cfgcmd:: set policy route rule recent - <1-255|0-4294967295> +.. cfgcmd:: set policy route rule recent count <1-255> +.. cfgcmd:: set policy route6 rule recent count <1-255> +.. cfgcmd:: set policy route rule recent time <1-4294967295> +.. cfgcmd:: set policy route6 rule recent time <1-4294967295> Set parameters for matching recently seen sources. This match could be used by seeting count (source address seen more than <1-255> times) and/or time (source address seen in the last <0-4294967295> seconds). -.. cfgcmd:: set policy route rule set dscp <0-63> - - Set packet modifications: Packet Differentiated Services Codepoint (DSCP) - -.. cfgcmd:: set policy route rule set mark <1-2147483647> - - Set packet modifications: Packet marking - -.. cfgcmd:: set policy route rule set table - - Set packet modifications: Routing table to forward packet with. - -.. cfgcmd:: set policy route rule set tcp-mss <500-1460> - - Set packet modifications: Explicitly set TCP Maximum segment size value. - -.. cfgcmd:: set policy route rule source address - - - Set match criteria based on source address, where could be: - - * : IP address to match. - * : Subnet to match. - * -: IP range to match. - * !: Match everything except the specified address. - * !: Match everything except the specified subnet. - * !-: Match everything except the specified range. - -.. cfgcmd:: set policy route rule source group - - - Set source match criteria based on groups, where would be the group - name/identifier. - -.. cfgcmd:: set policy route rule source port - - Set match criteria based on source port, where could be: - - * : Named port (any name in /etc/services, e.g., http). - * <1-65535>: Numbered port. - * -: Numbered port range (e.g., 1001-1005). - - Multiple source ports can be specified as a comma-separated list. The whole - list can also be "negated" using '!'. For example: - '!22,telnet,http,123,1001-1005' - .. cfgcmd:: set policy route rule state - + +.. cfgcmd:: set policy route6 rule state + Set match criteria based on session state. .. cfgcmd:: set policy route rule tcp flags +.. cfgcmd:: set policy route6 rule tcp flags Set match criteria based on tcp flags. Allowed values for TCP flags: SYN ACK FIN RST URG PSH ALL. When specifying more than one flag, flags should be @@ -180,241 +188,60 @@ Route packets with the SYN flag set, and the ACK, FIN and RST flags unset. .. cfgcmd:: set policy route rule time monthdays - - Set monthdays to match rule on. Format for monthdays: 2,12,21. - To negate add ! at the front eg. !2,12,21 - +.. cfgcmd:: set policy route6 rule time monthdays .. cfgcmd:: set policy route rule time startdate - - Set date to start matching rule. Format for date: yyyy-mm-dd. To specify - time of date with startdate, append 'T' to date followed by time in 24 hour - notation hh:mm:ss. For eg startdate value of 2009-01-21T13:30:00 refers to - 21st Jan 2009 with time 13:30:00. - +.. cfgcmd:: set policy route6 rule time startdate .. cfgcmd:: set policy route rule time starttime - - Set time of day to start matching rule. Format of time: hh:mm:ss using 24 - hours notation. - +.. cfgcmd:: set policy route6 rule time starttime .. cfgcmd:: set policy route rule time stopdate - - Set date to stop matching rule. Format for date: yyyy-mm-dd. To specify time - of date with stopdate, append 'T' to date followed by time in 24 hour - notation hh:mm:ss. For eg startdate value of 2009-01-21T13:30:00 refers to - 21st Jan 2009 with time 13:30:00. - +.. cfgcmd:: set policy route6 rule time stopdate .. cfgcmd:: set policy route rule time stoptime - - Set time of day to stop matching rule. Format of time: hh:mm:ss using 24 - hours notation. - +.. cfgcmd:: set policy route6 rule time stoptime +.. cfgcmd:: set policy route rule time weekdays +.. cfgcmd:: set policy route6 rule time weekdays .. cfgcmd:: set policy route rule time utc +.. cfgcmd:: set policy route6 rule time utc - Interpret times for startdate, stopdate, starttime and stoptime to be UTC. - -.. cfgcmd:: set policy route rule time weekdays - - Weekdays to match rule on. Format for weekdays: Mon,Thu,Sat. To negate add ! - at the front eg. !Mon,Thu,Sat. + Time to match the defined rule. +.. cfgcmd:: set policy route rule ttl <0-255> -IPv6 Route -========== + Match time to live parameter, where 'eq' stands for 'equal'; 'gt' stands for + 'greater than', and 'lt' stands for 'less than'. -.. cfgcmd:: set policy route6 +.. cfgcmd:: set policy route6 rule hop-limit <0-255> - This command creates a new IPv6 route policy, identified by . + Match hop-limit parameter, where 'eq' stands for 'equal'; 'gt' stands for + 'greater than', and 'lt' stands for 'less than'. -.. cfgcmd:: set policy route6 description +Actions +======= - Set description for the IPv6 route policy. - -.. cfgcmd:: set policy route6 enable-default-log - - Option to log packets hitting default-action. +When mathcing all patterns defined in a rule, then different actions can +be made. This includes droping the packet, modifying certain data, or +setting a different routing table. +.. cfgcmd:: set policy route rule action drop .. cfgcmd:: set policy route6 rule action drop Set rule action to drop. -.. cfgcmd:: set policy route6 rule description - - Set description for rule in IPv6 route policy. - -.. cfgcmd:: set policy route6 rule destination address - - - Set match criteria based on destination IPv6 address, where - could be: - - * : IPv6 address to match. - * : IPv6 prefix to match. - * -: IPv6 range to match. - * !: Match everything except the specified address. - * !: Match everything except the specified prefix. - * !-: Match everything except the - specified range. - -.. cfgcmd:: set policy route6 rule destination port - - Set match criteria based on destination port, where could - be: - - * : Named port (any name in /etc/services, e.g., http). - * <1-65535>: Numbered port. - * -: Numbered port range (e.g., 1001-1005). - - Multiple destination ports can be specified as a comma-separated list. The - whole list can also be "negated" using '!'. For example: - '!22,telnet,http,123,1001-1005'. - -.. cfgcmd:: set policy route6 rule disable - - Option to disable rule. - -.. cfgcmd:: set policy route6 rule icmpv6 type - - Set ICMPv6 match criterias, based on ICMPv6 type/code name. - -.. cfgcmd:: set policy route6 rule ipsec - - - Set IPSec inbound match criterias, where: - - * match-ipsec: match inbound IPsec packets. - * match-none: match inbound non-IPsec packets. - -.. cfgcmd:: set policy route6 rule limit burst - <0-4294967295> - - Set maximum number of packets to alow in excess of rate - -.. cfgcmd:: set policy route6 rule limit rate - - Set maximum average matching rate. Format for rate: integer/time_unit, where - time_unit could be any one of second, minute, hour or day.For example - 1/second implies rule to be matched at an average of once per second. - -.. cfgcmd:: set policy route6 rule log - - Option to enable or disable log matching rule. - -.. cfgcmd:: set policy route6 rule log - - Option to log matching rule. - -.. cfgcmd:: set policy route6 rule protocol - - - Set IPv6 protocol to match. IPv6 protocol name from /etc/protocols or - protocol number, or "tcp_udp" or "all". Also, protocol could be denied by - using !. - -.. cfgcmd:: set policy route6 rule recent - <1-255|0-4294967295> - - Set parameters for matching recently seen sources. This match could be used - by seeting count (source address seen more than <1-255> times) and/or time - (source address seen in the last <0-4294967295> seconds). - +.. cfgcmd:: set policy route rule set dscp <0-63> .. cfgcmd:: set policy route6 rule set dscp <0-63> Set packet modifications: Packet Differentiated Services Codepoint (DSCP) +.. cfgcmd:: set policy route rule set mark <1-2147483647> .. cfgcmd:: set policy route6 rule set mark <1-2147483647> - Set packet modifications: Packet marking. + Set packet modifications: Packet marking -.. cfgcmd:: set policy route6 rule set table +.. cfgcmd:: set policy route rule set table
+.. cfgcmd:: set policy route6 rule set table
Set packet modifications: Routing table to forward packet with. -.. cfgcmd:: set policy route6 rule set tcp-mss - - - Set packet modifications: pmtu option automatically set to Path Maximum - Transfer Unit minus 60 bytes. Otherwise, expliicitly set TCP MSS value from - 500 to 1460. - -.. cfgcmd:: set policy route6 rule source address - - - Set match criteria based on IPv6 source address, where - could be: - - * : IPv6 address to match - * : IPv6 prefix to match - * -: IPv6 range to match - * !: Match everything except the specified address - * !: Match everything except the specified prefix - * !-: Match everything except the - specified range - -.. cfgcmd:: set policy route6 rule source mac-address - - - Set source match criteria based on MAC address. Declare specific MAC address - to match, or match everything except the specified MAC. - -.. cfgcmd:: set policy route6 rule source port - - - Set match criteria based on source port, where could be: - - * : Named port (any name in /etc/services, e.g., http). - * <1-65535>: Numbered port. - * -: Numbered port range (e.g., 1001-1005). - - Multiple source ports can be specified as a comma-separated list. The whole - list can also be "negated" using '!'. For example: - '!22,telnet,http,123,1001-1005'. - -.. cfgcmd:: set policy route6 rule state - - - Set match criteria based on session state. - -.. cfgcmd:: set policy route6 rule tcp flags - - Set match criteria based on tcp flags. Allowed values for TCP flags: SYN ACK - FIN RST URG PSH ALL. When specifying more than one flag, flags should be - comma-separated. For example : value of 'SYN,!ACK,!FIN,!RST' will only match - packets with the SYN flag set, and the ACK, FIN and RST flags unset. - -.. cfgcmd:: set policy route6 rule time monthdays - - Set monthdays to match rule on. Format for monthdays: 2,12,21. - To negate add ! at the front eg. !2,12,21 - -.. cfgcmd:: set policy route6 rule time startdate - - Set date to start matching rule. Format for date: yyyy-mm-dd. To specify - time of date with startdate, append 'T' to date followed by time in 24 hour - notation hh:mm:ss. For eg startdate value of 2009-01-21T13:30:00 refers to - 21st Jan 2009 with time 13:30:00. - -.. cfgcmd:: set policy route6 rule time starttime - - Set time of day to start matching rule. Format of time: hh:mm:ss using 24 - hours notation. - -.. cfgcmd:: set policy route6 rule time stopdate - - Set date to stop matching rule. Format for date: yyyy-mm-dd. To specify time - of date with stopdate, append 'T' to date followed by time in 24 hour - notation hh:mm:ss. For eg startdate value of 2009-01-21T13:30:00 refers to - 21st Jan 2009 with time 13:30:00. - -.. cfgcmd:: set policy route6 rule time stoptime - - Set time of day to stop matching rule. Format of time: hh:mm:ss using 24 - hours notation. - -.. cfgcmd:: set policy route6 rule time utc - - Interpret times for startdate, stopdate, starttime and stoptime to be UTC. - -.. cfgcmd:: set policy route6 rule time weekdays +.. cfgcmd:: set policy route rule set tcp-mss <500-1460> +.. cfgcmd:: set policy route6 rule set tcp-mss <500-1460> - Weekdays to match rule on. Format for weekdays: Mon,Thu,Sat. To negate add ! - at the front eg. !Mon,Thu,Sat. + Set packet modifications: Explicitly set TCP Maximum segment size value. \ No newline at end of file -- cgit v1.2.3