IP Firewall
6 NN40011-045 Issue 1.2 BCM50 Rls 6.0
attack, where an attacker tries to block valid users from accessing a resource
or a server.
Stateful filtering supports TCP, UDP, IP, and ICMP. Stateful filtering supports
the following applications: H.323, FTP, HTTP, POP3, Telnet, SMTP, DNS,
DHCP, TFTP, GOPHER, FINGER, NNTP, NetBIOS, POP2, RPC, SNMP and
SUNNFS.
Denial of Service (DoS) Attacks
Denials of Service (DoS) attacks are aimed at devices and networks with a
connection to the Internet. Their goal is not to steal information, but to disable
a device or network so users no longer have access to network resources.
The BCM50e/be Integrated Router is pre-configured to automatically detect
and thwart all known DoS attacks.
Default Configuration
By default, the BCM50 Integrated Router firewall is configured to allow all
traffic originating from the LAN and deny all traffic originating from the WAN.
Any traffic responding to requests from the LAN to the WAN, e.g. http traffic is
allowed through the firewall and returned to the request originator.
The exception to WAN originating traffic is IKE requests. IKE (Internet Key
Exchange) is
used to set up VPN’s (Virtual Private Network) connections.
Firewall Rules
Rule Direction
Rules can be configured for the direction of traffic in the following ways:
LAN to WAN: This direction is designed to stop some or all users on
the network accessing some services on the Internet. For example, if
certain users are less productive due to inappropriate usage of MSN
Messenger, those users (essentially IP Addresses) can be blocked
from using the MSN Messenger port (TCP port 1863).
WAN to LAN: By default, all traffic except IKE requests are blocked
from the WAN to the LAN. It is possible to allow certain traffic, e.g.
Element Manager, from a specific or multiple users based on their
WAN IP Address.
LAN to LAN: By default there are no rules configured for this option.
This allows computers on the LAN to manage the BCM50 Integrated
Router and communicate between networks or subnets connected to
the LAN interface.
WAN to WAN: By default all packets are blocked for this option. This
prevents computers on the WAN from using the BCM50 Integrated
Router as a gateway to communicate with other computers on the
WAN and/or managing the BCM50 Integrated Router.
