docker 4

bridge 1

network 2

base64 1

lua 2

kong 1

linux 4

figlet 1

asciinema 1

golang 2

kvm 1

macvtap 1

reading 3

db2 1

sql 2

ceph 1

mariadb 1

maxscale 1

shell 1

elasticsearch 1

logstash 1

numa 1

security 1

keepalived 1

logrotate 1

crontab 1

openstack 1

terminal 1

sdn 1

socat 1

openshift 2

k8s 2

jira 1

sso 1

superset 1


Best Practice in Vyatta

2017年09月25日 
__     __           _   _        
\ \   / /   _  __ _| |_| |_ __ _ 
 \ \ / / | | |/ _` | __| __/ _` |
  \ V /| |_| | (_| | |_| || (_| |
   \_/  \__, |\__,_|\__|\__\__,_|
        |___/

Firewall Configuration

Vyatta firewall provides the following features:

  • Packet filtering for traffic that traverses the router by using the in and out keywords on an interface.
  • Definable criteria for packet-matching rules, including source IP address, destination IP address, source port, destination port, IP protocol,
    and Internet Control Message Protocol (ICMP) type.
  • General detection on IP options, such as source routing and broadcast packets.
  • Ability to set the firewall globally for stateful or stateless operation.
  • Advanced firewall capabilities include stateful failover, zone-based firewalls, and time-based firewalls.

Firewall rules perform the following actions:

  • Accept, which means that traffic is allowed and forwarded
  • Drop, which means that traffic is silently discarded
  • Reject, which means that traffic is discarded with an ICMP Port Unreachable message

Applying firewall rules to interfaces:

  • In. If you apply the instance as in, the firewall filters packets that enter the interface and traverse the Vyatta system. You can apply one in packet filter.

  • Out. If you apply the instance as out, the firewall filters packets that leave the interface. These can be packets that traverse the Vyatta system or that
    originated on the system. You can apply one out packet filter.

  • Local. If you apply the instance as local, the firewall filters packets that are destined for the Vyatta system. One firewall instance can be applied as a local
    packet filter.