Examples
Access List samples
In all following examples we'll suppose that:
We will use ALO instead Access List Object and ALR instead of Access List Rule.
List of basic examples:
1) How to deny access only for one PC - ClientIP example.
1b) How to deny access only for selected
PCs - ClientIP example.
1c) How to deny all access from Internet
(allow only local stations) - InterfaceIP example.
2) How to allow access only for one PC - ClientIP example.
3) How to allow deny for one PC in
specified time range - ClientIP and Time
example.
4) How to enable use of HTTP Proxy service
only (other services are not allowed) - ServiceName example.
5) How to allow access only to the
specified URL in defined time range - LocalInt, Time and URL example.
6) How to use hidden authentication
feature - pass example.
7) How to allow access to the Admin
interface for one PC only - ClientIP, AdminURL
example.
List of extended examples:
1) Complicated example -:). See example
description - ClientIP, Time, ContentType and ServiceName example.
Description:
We want to deny access to all Proxy+ services for PC1.
Definition of ALOs:
We'll create ALO and we'll name it PC1. ClientIP will be type of this ALO and IP
address of PC1 will be its parameter, which is 192.168.0.10.
Following line will appear in the
list of ALOs (Defined objects) if defined correctly:
PC1=ClientIP;192.168.0.10
Definition of ALRs:
We'll type following line into Access List Rules on page
Access List/Rules:
deny PC1
Finally we'll save new list of ALRs by pressing Save button
and then we'll restart Proxy+.
Description:
We want to deny access to all Proxy+ services for
PCs with IP addresses from 192.168.0.10 to 192.168.0.20.
Definition of ALOs:
We'll create ALO and we'll name it PCS. ClientIP will be type of this ALO and IP
address range will be its parameter. I.e. parameter will be 192.168.0.10-192.168.0.20.
Following line will appear in the
list of ALOs (Defined objects) if defined correctly:
PCS=ClientIP;192.168.0.10-192.168.0.20
Definition of ALRs:
We'll type following line into Access List Rules on page
Access List/Rules:
deny PCS
Finally we'll save new list of ALRs by pressing Save button
and then we'll restart Proxy+.
Description:
We want to deny all access from
Internet. In another words we want to use Access List to secure Proxy+.
Definition of ALOs:
We'll create ALO and we'll name it LocalInt. InterfaceIP will be type of this ALO
and IP address of PC with Proxy+
will be its parameter. I.e. parameter will be 192.168.0.1. It
is IP of netcard through which the request of LAN station goes to this PC. Another
requests (requests from Internet) go through another interfaces such that we can easily
eliminate such requests.
Following line will appear in the
list of ALOs (Defined objects) if defined correctly:
LocalInt=InterfaceIP;192.168.0.1
Definition of ALRs:
We'll type following line into Access List Rules on page
Access List/Rules:
deny !LocalInt
Finally we'll save new list of ALRs by pressing Save button
and then we'll restart Proxy+.
Note: If you want to disable all request from Internet sources it is much better to use
Security settings instead of Access List.
Description:
We want to deny access to all Proxy+
services for all computers except PC1.
Definition of ALOs:
We'll create ALO and we'll name it PC1. ClientIP will be type of this ALO and IP
address of PC1 will be its parameter, which is 192.168.0.10.
Following line will appear in the
list of ALOs (Defined objects) if defined correctly:
PC1=ClientIP;192.168.0.10
Definition of ALRs:
We'll type following line into Access List Rules on page
Access List/Rules:
deny !PC1
The "!" character at the beginning of ALO name makes the rule valid everytime when the access comes from computer with IP address different from 192.168.0.10.
Finally we'll save new list of ALRs by pressing Save button and then we'll restart Proxy+.
Alternate solution:
This example can be solved by redefinition of the ALO which is used in the ALR then.
Definition of ALOs:
We'll create ALO and we'll name it NPC1. ClientIP will be type if this ALO and
negation of IP address of PC1 will be its parameter, which is !192.168.0.10.
The "!" character makes the ALO valid only if it's compared to an IP address
different from 192.168.0.10.
Following line will appear in the
list of ALOs (Defined objects) if defined correctly:
PC1=ClientIP;!192.168.0.10
Definition of ALRs:
We'll type following line into Access List Rules on page
Access List/Rules:
deny NPC1
Finally we'll save new list of ALRs by pressing Save button
and then we'll restart Proxy+.
Description:
We want to deny access to all Proxy+ services for PC1 in time between 7:30 am and 5:00
PM.
Definition of ALOs:
We'll create ALO and we'll name it PC1. ClientIP will be type of this ALO and IP
address of PC1 will be its parameter, which is 192.168.0.10.
Next we'll create ALO and we'll name it TIME. Time will be type of this ALO and
time range will be its parameter, which is 7:30-17:00
Following lines will appear in the
list of ALOs (Defined objects) if defined correctly:
PC1=ClientIP;192.168.0.10
TIME=Time;07:30-17:00
Definition of ALRs:
We'll type following line into Access List Rules on page
Access List/Rules:
deny PC1 TIME
This combination of PC1 and TIME ALOs makes the rule valid only if the request comes from computer with IP 192.168.0.10 in time between 7:30 am and 5:00 PM.
Finally we'll save new list of ALRs by pressing Save button
and then we'll restart Proxy+.
Description:
We want to allow access to HTTP Proxy service only for all computers.
Definition of ALOs:
We'll create ALO and we'll name it HTTPProxy. ServiceName will be type of this ALO
and text "HTTP" will be its parameter.
Following lines will appear in the
list of ALOs (Defined objects) if defined correctly:
HTTPProxy=ServiceName;HTTP
Definition of ALRs:
We'll type following line into Access List Rules on page
Access List/Rules:
deny !HTTPProxy
Finally we'll save new list of ALRs by pressing Save button
and then we'll restart Proxy+.
Description:
We want:
Definition of ALOs:
We'll create ALO and we'll name it LocalInt. InterfaceIP will be type of this ALO
and IP address of interface through which requests can come will be its parameter, which
is 192.168.0.1.
Next we'll create ALO and we'll name it TIME. Time will be type of this ALO and
time range will be its parameter, which is 7:30-15:30.
Next we'll create ALO and we'll name it Address. URL will be type of this ALO and text
"www.company.com" will be its parameter.
Following lines will appear in the
list of ALOs (Defined objects) if defined correctly:
LocalInt=InterfaceIP;192.168.0.1
TIME=Time;07:00-15:30
Address=URL;www.company.com
Definition of ALRs:
We'll type following line into Access List Rules on page
Access List/Rules:
deny !LocalInt
deny LocalIP !Address TIME
Finally we'll save new list of ALRs by pressing Save button
and then we'll restart Proxy+.
Description:
We want to complete requests from computer PC1 with username and password when accessing
documents on WWW server.
URL addresses of secret documents starts with: www.server.com/secret
Username is: user
Password is: passwd1
Note: This feature can be used to add username/password to the requests without client knowledge. In another words - the client needn't to know username nor password. Only system administrator knows them.
Definition of ALOs:
We'll create ALO and we'll name it PC1. ClientIP will be type of this ALO and IP
address of PC1 will be its parameter, which is 192.168.0.10.
Next we'll create ALO and we'll name it Secret. URL will be type of this ALO and
URL of documents will be its parameter, which is http://www.server.com/secret.
Next we'll create ALO and we'll name it Password. Parameter will be type of this
ALO and text "user:passwd1" will be its parameter.
Following lines will appear in the
list of ALOs (Defined objects) if defined correctly:
PC1=ClientIP;192.168.0.10
Secret=URL;http://www.server.com/secret
Password=Parameter;user:passwd1
Definition of ALRs:
We'll type following line into Access List Rules on page
Access List/Rules:
pass PC1 Secret Password
Finally we'll save new list of ALRs by pressing Save button and then we'll restart Proxy+.
Description:
We want to allow access to Proxy+'s WWW Admin interface
only for PC1.
Definition of ALOs:
We'll create ALO and we'll name it PC1. ClientIP will be type of this ALO and IP
address of PC1 will be its parameter, which is 192.168.0.10.
We'll create ALO and we'll name it Admin. AdminURL will be type of this ALO and '*'
will be its parameter.
Following line will appear in the
list of ALOs (Defined objects) if defined correctly:
PC1=ClientIP;192.168.0.10
Admin=AdminURL;*
Definition of ALRs:
We'll type following line into Access List Rules on page
Access List/Rules:
deny !PC1 Admin
or you can use following longer definition too:
allow PC1 Admin
deny Admin
Finally we'll save new list of ALRs by pressing Save button and then we'll restart Proxy+.
Description:
We want:
Definition of ALOs:
We'll create ALO and we'll name it PC1. ClientIP will be type of this ALO and IP
address of PC1 will be its parameter, which is 192.168.0.10.
Next we'll create ALO and we'll name it LocalIP. ClientIP will be type of this ALO
and list of local IPs will be its parameter, which is 192.168.0.0/255.255.255.0.
Next we'll create ALO and we'll name it Proxy. ServiceName will be type of this ALO
and list of allowed services will be its parameter, which is text "HTTP, FTP,
FTPG".
Next we'll create ALO and we'll name it TIME. Time will be type of this ALO and
time range will be its parameter, which is 7:30-15:30.
Next we'll create ALO and we'll name it SaSu. Time will be type of this ALO and
specification of weekend days will be its parameter, which is text "Saturday,
Sunday".
Finally we'll create ALO and we'll name it Content. ContentType will be type of
this ALO and list of allowed file type will be its parameter, which is text "text/*,
image/*".
Following lines will appear in the
list of ALOs (Defined objects) if defined correctly:
LocalIP=ClientIP;192.168.0.0/255.255.255.0
PC1P=ClientIP;192.168.0.10
Proxy=ServiceName;HTTP,FTP,FTPG
TIME=Time;07:00-15:30
SaSu=Time;Saturday,Sunday
Content=ContentType;text/*,image/*
Definition of ALRs:
We'll type following line into Access List Rules on page
Access List/Rules:
allow PC1
deny !LocalIP
deny LocalIP !TIME
deny LocalIP !Proxy
deny LocalIP SaSu
deny LocalIP !Content
ALRs can be specified as following too:
allow PC1
deny !LocalIP
deny !TIME
deny !Proxy
deny SaSu
deny !Content
It's possible because we filtered out IP addresses of computers with specific access rights on first two lines, so no computer with IP different from those defined in LocalIP can reach rules on line 3 and further and thus it's possible to skip LocalIP in definition of those ALRs.
Finally we'll save new list of ALRs by pressing Save button and then we'll restart Proxy+.
Related Links:
Art04113 - I can't access the P+ due to incorrect
Access List settings