Access policy rules belong to the object "Policy", which is a child
object of the firewall and can be found in the tree below it. As
with any other object in Firewall Builder, the Policy object has
some attributes that you can edit if you double-click on it in the
tree.
-
Policy can be IPv4, IPv6, or combined IPv4 and IPv6. In the last
case you can use a mix of IPv4 and IPv6 address objects in the
same policy (in different rules), and Firewall Builder will
automatically figure out which one is which and sort them out.
-
Policy can translate into only the mangle table (used for
modifying packets) or a combination of the filter table (used
for allowing/blocking packets) and the mangle table. In the
latter case, the policy compiler decides which table to use
based on the rule action and service object. Some actions, such
as "Tag" (which translates into iptables target MARK), go into
mangle table.
-
The "Top rule set" is the one the compiler will use to populate
iptables built-in chains INPUT/OUTPUT/FORWARD. (If you have only
one rule set, then mark it as the top rule set.) If a policy is
not marked as "top rule set", generated rules will go into a
user-defined chain with the same name as the policy object.