Advanced firewall features

Content filtering with string matching

Content filtering feature can be optionally used for simple URL blocking and malicious content filter. However, do take note below limitations:

• • mbox content filtering scans and drops unwanted packets, whether the packets are from body text or URL requests. So if the string pattern appears in the body text, the packet will be dropped as well.

  • if the string pattern happens to be splitted into two packets, it will not be matched

  • if the string contains space, we need to use “ “ to include the whole contents together.

CONFIGURATION EXAMPLES

filter anything containing “playboy.com”, will match both URI and bodytext

deny vulnerability scan to web server

deny malicious url attack to an web server

DDoS prevention with rate limiting

mbox can limit packets passing through mbox at desirable rate to suppress some busty connections or prevent volumetric-based DDoS attacks. The simplest way to prevent volumetric-based DDoS attack is to limit per host/connection bandwidth usage so that the packets coming in or towards a target destination will not be overwhelmed.

CONFIGURATION EXAMPLES

limit “100 packets per second for every host in 192.168.1.0/24”

MAC address filtering

mbox can deny/permit specific hosts based on host MAC address (source host). Use the src_mac option.

Below example prevents host access through mbox. if you want to prevent the host to access sources on mbox (eg. ssh, http, etc), use firewall-input rules.

Disable default firewall rules

mbox comes with a default set of firewall rules loaded when it boots up. Whatever new rules added from CLI are appended behind default rules. You can use "show firewall input-list all" or "show firewall access-list all" to view the default rules. The default rules are remarked as "DEFAULTHIDE99", for example

Note the default firewall rules are essential to permit some default services, however, sometimes it may be disirable to disable some default services due to coorporate security policy. For example, you may want to disable ping/ICMP and don't want to allow IPSec (ESP, UDP/500) etc. So we can use firewall-disable CLI to remove the default rules, 

below rule disables ICMP ping to mbox itself.