Different rules can be associated with listeners, meant to sort connections based on various parameters, and to reject (deny rules) or accept (allow rules) them accordingly. Using deny and allow rules you can automatically accept/deny connections from specific IP addresses.

Allow/Deny Rules

Allow/Deny rules enable you to specify the rules for accepting/rejecting connections when these connections follow the limitations imposed by the listener.

Allow/Deny Rules are defined using the following general attributes:

• specify a network/mask, IP range or single IP for which the reject/allow rule is applied
• check or uncheck the 'enable' option to specify if the rule is enabled or not

You can then set priorities for when applying the rules and impose further connection limitations using the flow control parameters described below:

• max. number of simultaneous connections and max. number of new connections in a defined time interval (seconds/minutes/hours/days) - these parameters impose limitations on the number of connections initiated by any address within the rule IP set
  
• max. connections from each remote IP address and max. connections from each remote IP address in a defined time interval (seconds/minutes/hours/days) - these parameters impose limitations on the number of connections initiated by the same address within the rule IP set

Rule Enforcement Policy

The policy for applying accept and deny rules for connections to listeners is described below:

1. The IP address from which the connection has been initiated is exposed.
2. AXIGEN verifies if this IP address is part of a set of IP addresses associated to one or more deny rules; if yes, the deny rule with the highest priority (meaning LOWEST value for the priority attribute) is applied.
3. AXIGEN verifies if this IP address is part of a set of IP addresses associated to one or more accept rules; if yes, the accept rule with the highest priority (meaning LOWEST value for priority attribute) is applied.
4. If the IP address from which the connection has been initiated is associated only with a deny rule, the connection is denied (closed)
5. If the IP address from which the connection has been initiated is associated with both a deny AND an allow rule, the rule with the highest priority is applied. If the rule with the highest priority is a deny rule, the connection is denied (closed). If the rule with the highest priority is an allow rule, the limitations (if any) for the specified connections from the allow rule are applied. If the allow rule and the deny rule have the same priority, the connection is accepted.
6. If the IP address from which the connection has been initiated is associated only with an accept rule, the verifications defined for connections in the accept rule are applied, and if fulfilled, the connection is accepted.

After applying the limitations imposed by the rules, the global limitations defined at listener level are applied. Only then the connection is accepted (and the respective service protocol is applied on the accepted connection).

If no allow rule is defined for the IP address from which the connection has been initiated, then the connection is considered as fulfilling the rules and the verifications defined globally (if any) for the current listener are applied.

For details on how to configure rules using WebAdmin, see Adding and Editing TCP Rules. You can also configure Rules using CLI, for more details see Configuring AXIGEN using CLI.