8.4 Filtering Rules Explained
Key Concepts
- Filtering Rules
- Match Criteria
- Action Types
- Logging
- Configuration and Implementation
1. Filtering Rules
Filtering rules are used to control and manage network traffic by specifying conditions under which packets are allowed or denied. These rules help in securing the network by blocking unwanted traffic and allowing only authorized traffic to pass through.
Example: Think of filtering rules as a security guard at a gated community. Just as the guard allows residents and their guests to enter while keeping out strangers, filtering rules allow authorized traffic while blocking unauthorized traffic.
2. Match Criteria
Match criteria define the conditions that packets must meet to be affected by a filtering rule. These criteria can include parameters such as source IP address, destination IP address, protocol type, port number, and more. Matching the correct criteria ensures that the rule is applied accurately.
Example: Consider match criteria as a set of instructions for a security guard. Just as the guard checks for a valid ID and vehicle pass, match criteria check for specific parameters in the packets to determine if they should be allowed or denied.
3. Action Types
Action types define what happens to the packets that match the filtering criteria. Common actions include allowing the packet to pass, dropping the packet, or rejecting the packet with an error message. The choice of action depends on the network policy and the desired outcome.
Example: Think of action types as different responses to a security breach. Just as a security guard can allow entry, deny entry, or call for backup, action types can allow packets, drop packets, or reject packets with an error message.
4. Logging
Logging involves recording the actions taken by the filtering rules, such as which packets were allowed, denied, or dropped. This information is useful for monitoring network activity, troubleshooting issues, and ensuring compliance with security policies.
Example: Consider logging as a surveillance system in a gated community. Just as the surveillance system records who enters and exits, logging records which packets are allowed or denied, providing a record for future reference.
5. Configuration and Implementation
Configuring and implementing filtering rules on a MikroTik router involves several steps:
- Define Match Criteria: Specify the conditions that packets must meet to be affected by the rule.
- Select Action Types: Choose the action to be taken for packets that match the criteria (allow, drop, reject).
- Enable Logging: Decide whether to log the actions taken by the filtering rules for monitoring and troubleshooting purposes.
- Apply Rules: Apply the configured rules to the appropriate interfaces or firewall chains to enforce the filtering policies.
- Test and Monitor: Test the rules to ensure they work as intended and monitor the network to make adjustments as necessary.
Example: Configuring filtering rules is like setting up a security system. You need to define the criteria for entry (match criteria), decide the response to unauthorized access (action types), record the activities (logging), apply the rules to the appropriate areas (interfaces), and test the system to ensure it works correctly.