1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
|
#######################
Route and Route6 Policy
#######################
IPv4 route and IPv6 route policies are defined in this section. These route
policies can then be associated to interfaces.
*********
Rule-Sets
*********
A rule-set is a named collection of rules that can be applied to an interface.
Each rule is numbered, has an action to apply if the rule is matched, and the
ability to specify the criteria to match. Data packets go through the rules
from 1 - 999999, at the first match the action of the rule will be executed.
.. cfgcmd:: set policy route <name> description <text>
.. cfgcmd:: set policy route6 <name> description <text>
Provide a rule-set description.
.. cfgcmd:: set policy route <name> default-log
.. cfgcmd:: set policy route6 <name> default-log
Option to log packets hitting default-action.
.. cfgcmd:: set policy route <name> rule <n> description <text>
.. cfgcmd:: set policy route6 <name> rule <n> description <text>
Provide a description for each rule.
.. cfgcmd:: set policy route <name> rule <n> log <enable|disable>
.. cfgcmd:: set policy route6 <name> rule <n> log <enable|disable>
Option to enable or disable log matching rule.
Matching criteria
=================
There are a lot of matching criteria options available, both for
``policy route`` and ``policy route6``. These options are listed
in this section.
.. cfgcmd:: set policy route <name> rule <n> connection-mark <1-2147483647>
.. cfgcmd:: set policy route6 <name> rule <n> connection-mark <1-2147483647>
Set match criteria based on connection mark.
.. cfgcmd:: set policy route <name> rule <n> source address
<match_criteria>
.. cfgcmd:: set policy route <name> rule <n> destination address
<match_criteria>
.. cfgcmd:: set policy route6 <name> rule <n> source address
<match_criteria>
.. cfgcmd:: set policy route6 <name> rule <n> destination address
<match_criteria>
Set match criteria based on source or destination ipv4|ipv6 address, where
<match_criteria> could be:
For ipv4:
* <x.x.x.x>: IP address to match.
* <x.x.x.x/x>: Subnet to match.
* <x.x.x.x>-<x.x.x.x>: IP range to match.
* !<x.x.x.x>: Match everything except the specified address.
* !<x.x.x.x/x>: Match everything except the specified subnet.
* !<x.x.x.x>-<x.x.x.x>: Match everything except the specified range.
And for ipv6:
* <h:h:h:h:h:h:h:h>: IPv6 address to match.
* <h:h:h:h:h:h:h:h/x>: IPv6 prefix to match.
* <h:h:h:h:h:h:h:h>-<h:h:h:h:h:h:h:h>: IPv6 range to match.
* !<h:h:h:h:h:h:h:h>: Match everything except the specified address.
* !<h:h:h:h:h:h:h:h/x>: Match everything except the specified prefix.
* !<h:h:h:h:h:h:h:h>-<h:h:h:h:h:h:h:h>: Match everything except the
specified range.
.. cfgcmd:: set policy route <name> rule <n> source group
<address-group|domain-group|mac-group|network-group|port-group> <text>
.. cfgcmd:: set policy route <name> rule <n> destination group
<address-group|domain-group|mac-group|network-group|port-group> <text>
.. cfgcmd:: set policy route6 <name> rule <n> source group
<address-group|domain-group|mac-group|network-group|port-group> <text>
.. cfgcmd:: set policy route6 <name> rule <n> destination group
<address-group|domain-group|mac-group|network-group|port-group> <text>
Set match criteria based on source or destination groups, where <text>
would be the group name/identifier. Prepend character '!' for inverted
matching criteria.
.. cfgcmd:: set policy route <name> rule <n> destination port <match_criteria>
.. cfgcmd:: set policy route6 <name> rule <n> destination port <match_criteria>
Set match criteria based on destination port, where <match_criteria> could
be:
* <port name>: Named port (any name in /etc/services, e.g., http).
* <1-65535>: Numbered port.
* <start>-<end>: Numbered port range (e.g., 1001-1005).
Multiple destination ports can be specified as a comma-separated list. The
whole list can also be "negated" using '!'. For example:
'!22,telnet,http,123,1001-1005'
.. cfgcmd:: set policy route <name> rule <n> disable
.. cfgcmd:: set policy route6 <name> rule <n> disable
Option to disable rule.
.. cfgcmd:: set policy route <name> rule <n> dscp <text>
.. cfgcmd:: set policy route6 <name> rule <n> dscp <text>
.. cfgcmd:: set policy route <name> rule <n> dscp-exclude <text>
.. cfgcmd:: set policy route6 <name> rule <n> dscp-exclude <text>
Match based on dscp value criteria. Multiple values from 0 to 63
and ranges are supported.
.. cfgcmd:: set policy route <name> rule <n> fragment
<match-grag|match-non-frag>
.. cfgcmd:: set policy route6 <name> rule <n> fragment
<match-grag|match-non-frag>
Set IP fragment match, where:
* match-frag: Second and further fragments of fragmented packets.
* match-non-frag: Head fragments or unfragmented packets.
.. cfgcmd:: set policy route <name> rule <n> icmp <code | type>
.. cfgcmd:: set policy route6 <name> rule <n> icmpv6 <code | type>
Match based on icmp|icmpv6 code and type.
.. cfgcmd:: set policy route <name> rule <n> icmp type-name <text>
.. cfgcmd:: set policy route6 <name> rule <n> icmpv6 type-name <text>
Match based on icmp|icmpv6 type-name criteria. Use tab for information
about what type-name criteria are supported.
.. cfgcmd:: set policy route <name> rule <n> ipsec
<match-ipsec|match-none>
.. cfgcmd:: set policy route6 <name> rule <n> ipsec
<match-ipsec|match-none>
Set IPSec inbound match criterias, where:
* match-ipsec: match inbound IPsec packets.
* match-none: match inbound non-IPsec packets.
.. cfgcmd:: set policy route <name> rule <n> limit burst <0-4294967295>
.. cfgcmd:: set policy route6 <name> rule <n> limit burst <0-4294967295>
Set maximum number of packets to alow in excess of rate.
.. cfgcmd:: set policy route <name> rule <n> limit rate <text>
.. cfgcmd:: set policy route6 <name> rule <n> limit rate <text>
Set maximum average matching rate. Format for rate: integer/time_unit, where
time_unit could be any one of second, minute, hour or day.For example
1/second implies rule to be matched at an average of once per second.
.. cfgcmd:: set policy route <name> rule <n> protocol
<text | 0-255 | tcp_udp | all >
.. cfgcmd:: set policy route6 <name> rule <n> protocol
<text | 0-255 | tcp_udp | all >
Match a protocol criteria. A protocol number or a name which is defined in:
``/etc/protocols``. Special names are ``all`` for all protocols and
``tcp_udp`` for tcp and udp based packets. The ``!`` negates the selected
protocol.
.. cfgcmd:: set policy route <name> rule <n> packet-length <text>
.. cfgcmd:: set policy route6 <name> rule <n> packet-length <text>
.. cfgcmd:: set policy route <name> rule <n> packet-length-exclude <text>
.. cfgcmd:: set policy route6 <name> rule <n> packet-length-exclude <text>
Match based on packet length criteria. Multiple values from 1 to 65535
and ranges are supported.
.. cfgcmd:: set policy route <name> rule <n> packet-type [broadcast | host
| multicast | other]
.. cfgcmd:: set policy route6 <name> rule <n> packet-type [broadcast | host
| multicast | other]
Match based on packet type criteria.
.. cfgcmd:: set policy route <name> rule <n> recent count <1-255>
.. cfgcmd:: set policy route6 <name> rule <n> recent count <1-255>
.. cfgcmd:: set policy route <name> rule <n> recent time <1-4294967295>
.. cfgcmd:: set policy route6 <name> rule <n> recent time <1-4294967295>
Set parameters for matching recently seen sources. This match could be used
by seeting count (source address seen more than <1-255> times) and/or time
(source address seen in the last <0-4294967295> seconds).
.. cfgcmd:: set policy route <name> rule <n> state
<established | invalid | new | related>
.. cfgcmd:: set policy route6 <name> rule <n> state
<established | invalid | new | related>
Set match criteria based on session state.
.. cfgcmd:: set policy route <name> rule <n> tcp flags <text>
.. cfgcmd:: set policy route6 <name> rule <n> tcp flags <text>
Set match criteria based on tcp flags. Allowed values for TCP flags: SYN ACK
FIN RST URG PSH ALL. When specifying more than one flag, flags should be
comma-separated. For example : value of 'SYN,!ACK,!FIN,!RST' will only match
packets with the SYN flag set, and the ACK, FIN and RST flags unset.
.. cfgcmd:: set policy route <name> rule <n> time monthdays <text>
.. cfgcmd:: set policy route6 <name> rule <n> time monthdays <text>
.. cfgcmd:: set policy route <name> rule <n> time startdate <text>
.. cfgcmd:: set policy route6 <name> rule <n> time startdate <text>
.. cfgcmd:: set policy route <name> rule <n> time starttime <text>
.. cfgcmd:: set policy route6 <name> rule <n> time starttime <text>
.. cfgcmd:: set policy route <name> rule <n> time stopdate <text>
.. cfgcmd:: set policy route6 <name> rule <n> time stopdate <text>
.. cfgcmd:: set policy route <name> rule <n> time stoptime <text>
.. cfgcmd:: set policy route6 <name> rule <n> time stoptime <text>
.. cfgcmd:: set policy route <name> rule <n> time weekdays <text>
.. cfgcmd:: set policy route6 <name> rule <n> time weekdays <text>
.. cfgcmd:: set policy route <name> rule <n> time utc
.. cfgcmd:: set policy route6 <name> rule <n> time utc
Time to match the defined rule.
.. cfgcmd:: set policy route rule <n> ttl <eq | gt | lt> <0-255>
Match time to live parameter, where 'eq' stands for 'equal'; 'gt' stands for
'greater than', and 'lt' stands for 'less than'.
.. cfgcmd:: set policy route6 rule <n> hop-limit <eq | gt | lt> <0-255>
Match hop-limit parameter, where 'eq' stands for 'equal'; 'gt' stands for
'greater than', and 'lt' stands for 'less than'.
Actions
=======
When mathcing all patterns defined in a rule, then different actions can
be made. This includes droping the packet, modifying certain data, or
setting a different routing table.
.. cfgcmd:: set policy route <name> rule <n> action drop
.. cfgcmd:: set policy route6 <name> rule <n> action drop
Set rule action to drop.
.. cfgcmd:: set policy route <name> rule <n> set connection-mark
<1-2147483647>
.. cfgcmd:: set policy route6 <name> rule <n> set connection-mark
<1-2147483647>
Set a specific connection mark.
.. cfgcmd:: set policy route <name> rule <n> set dscp <0-63>
.. cfgcmd:: set policy route6 <name> rule <n> set dscp <0-63>
Set packet modifications: Packet Differentiated Services Codepoint (DSCP)
.. cfgcmd:: set policy route <name> rule <n> set mark <1-2147483647>
.. cfgcmd:: set policy route6 <name> rule <n> set mark <1-2147483647>
Set a specific packet mark.
.. cfgcmd:: set policy route <name> rule <n> set table <main | 1-200>
.. cfgcmd:: set policy route6 <name> rule <n> set table <main | 1-200>
Set the routing table to forward packet with.
.. cfgcmd:: set policy route <name> rule <n> set tcp-mss <500-1460>
.. cfgcmd:: set policy route6 <name> rule <n> set tcp-mss <500-1460>
Set packet modifications: Explicitly set TCP Maximum segment size value.
|
