I'm not sure how else to describe it except as I did previously. I think
you're simply expecting the wrong behaviour from a rule just because it's
described as having "priority". That doesn't mean priority in establishing
or modifying the baseline condition, but priority in when it's executed.
For example, let's assume you tell your three-year old, "Never cross any
street unless a parent is with you." But obviously that rule is too
restrictive, so you add further conditions like "Never cross any street
unless there is a trusted adult present". If given in that order the rules
make perfect sense and you get the expected behaviour. But if you change
the order of the rules you create confusion - "Never cross any street unless
a trusted adult is present", but "Never cross any street unless a parent is
with you" results in behaviour you don't expect.
--
Richard G. Harper [MVP Win9x]
(E-Mail Removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ...
http://www.dts-l.org/goodpost.htm
"*Vanguard*" <no-(E-Mail Removed)> wrote in message
news:q_Sdnfqwm4Eud-(E-Mail Removed)...
> "Richard G. Harper" said in news:(E-Mail Removed):
> > I think you're confusing "priority" with "exclusivity". The first
> > rule is indeed taking priority and saying, "block all traffic". But
> > the second rule then modifies the first by creating a hole where
> > traffic from the LAN is permitted to pass through. Each rule is
> > applied to the router in the order specified so that lower
> > instructions may modify the earlier ones to allow limited exceptions.
>
> Like you said, it seems like a later rule will override the conditions
> established by prior rules. That's why I think the manual is wrong and
> real priority is lowest to highest in top-down order. As you said, the
> second rule modifies, or overrides, conditions set forth in a prior
> rule. That sure seems to be priority to me (with the 2nd rule having
> greater priority than the first rule). Exclusivity would be with the
> rules having a stop clause that would short-circuit the OR'ing of the
> rules: once a rule got triggered then subsequent rules do not get
> exercised (you stop, or short-circuit, the OR when the first condition
> gets triggered).
>
> Do you have a router with similar rules and also have more than one host
> to make sure the default behavior is to allow communication between the
> local hosts? This is what was my expectation of the router. As such,
> the rules would have to get exercised, like you say, with later rules
> overriding the conditions established by the prior rules. However, if
> that were true how would you block access to, say, an Internet site in
> your own rule if the later default rule overrides it?
>
> Say you have a rule that blocks LAN-WAN connections for all protocols to
> a WAN-side host with IP address 216.73.92.112. You never want any of
> your local hosts to connect to that site. So you define the rule:
>
> Name: Block Doubleclick.com
> Action = DENY
> Source = LAN,* (any local host, any port)
> Destination = WAN,216.73.92.112 (wwww.doublick.com)
> Protocols = *,* (all of them, any port)
>
> Supposedly this would prevent any of your local hosts from getting to
> doubleclick.com. That is a user-defined rule so it gets forced into the
> displayed rules list *before* the following default rule:
>
> Name: Default Rule #2
> Action = ALLOW
> Source = LAN,* (all LAN-side hosts, any IP address)
> Destination = *,* (all LAN- and WAN-side hosts, any IP address)
> Protocols = *,*
>
> This lets any local host connect to any Internet site. So if a later
> rule punches a hole in the conditions set forth in prior rules then this
> last "allow" rule obviates the user-defined site-specific "block" rule.
> Nothing you could define would block your local hosts from connecting to
> any Internet site. As you said, it is NOT likely that the rules are
> exclusive but instead get OR'ed. First I block LAN-WAN traffic to IP
> address 216.73.92.112 but then the later default rule unblocks *all*
> LAN-WAN traffic to *any* IP address. That means my block rule would
> never get honored.
>
> What I suspect is:
>
> - Priority is really lowest to highest in top-down order of the list.
> That means subsequent rules can override conditions established in prior
> rules which is the same as you believe.
> - The default rules are really at the top of the list although they are
> displayed at the bottom. This allows all local hosts to connect to any
> Internet site *unless* you define a subsequent rule to block the access.
> - The router excludes itself from any "deny LAN-LAN" rule.
>
> I have written to DLink but am still waiting for a reply. From prior
> correspondence with them, their response was not very helpful. Hell, it
> wasn't even on topic but more of a canned response.
>
Similar Threads
