Appendix C: Security
Stateful Packet Inspection
Refers to an architecture, where the firewall keeps track of packets on each
connection traversing all its interfaces and makes sure they are valid. This is in
contrast to static packet filtering which only examines a packet based on the
information in the packet header.
Denial of Service Attack
Is an incident in which a user or organization is deprived of the services of a
resource they would normally expect to have.
DoS attacks the device can withstand are: ARP Attack, Ping Attack, Ping of Death,
Land, SYN Attack, Smurf Attack and Tear Drop.
TCP/IP/Port/Interface Filter
These rules help in the filtering of traffic at the Network layer i.e. Layer 3.
When a Routing interface is created,
Enable Firewall
must be checked.
Navigate to Advanced Setup -> Security -> IP Filtering.
Outgoing IP Filter
Helps in setting rules to DROP packets from the LAN interface. By default if
Firewall is Enabled all IP traffic from LAN is allowed. By setting up one or
more filters, particular packet types coming from the LAN can be dropped.
Filter Name:
User defined Filter Name.
Protocol:
Can take on any values from: TCP/UDP, TCP, UDP or ICMP
Source IP Address/Source Subnet Mask:
Packets with the particular
“Source IP Address/Source Subnet Mask" combination will be dropped.
Source Port:
This can take on either a single port number or a range of
port numbers. Packets having a source port equal to this value or falling
within the range of port numbers (portX : portY) will be dropped.
Destination IP Address/Destination Subnet Mask:
Packets with the
particular "Destination IP Address/Destination Subnet Mask" combination
will be dropped.
Destination Port:
This can take on either a single port number or a range
of port numbers. Packets having a destination port equal to this value or
falling within the range of port numbers (portX : portY) will be dropped.
Example 1:
Filter
Name
:
Out_Filter1
Protocol :
TCP
Source
Address
:
192.168.1.45
Source
Subnet
Mask
:
255.255.255.0
Source Port
: 80
Destination
Address
:
NA
Destination Subnet Mask
: NA
Destination
Port
:
NA
This filter will Drop all TCP packets coming from LAN with IP Address/Sub.
Mask 192.168.1.45/24 having a source port of 80 irrespective of the
destination. All other packets will be Accepted.
Example 2:
78
Summary of Contents for CT-5611E
Page 1: ...CT 5611E ADSL2 Combo Router for Annex B User Manual Version A1 0 June 2 2008 261070 009...
Page 14: ...13...
Page 41: ...40...
