Chapter 2 - Features set
User Manual
R5000 series - Web GUI
67
2.4.6. IP Firewall
IP Firewall is a mechanism of filtering packets crossing an IP network node,
according to different criteria. System administrator may define a set of incoming
filters and a set of outgoing filters. The incoming filters determine which packets may
be accepted by the node. The outgoing filters determine which packets may be
forwarded by the node as a result of routing. Each filter describes a class of packets
and defines how these packets should be processed (reject and log, accept, accept
and log).
Packets can be filtered based on the following criteria:
Protocol (IP, TCP, UDP, ICMP, ARP)
Source address and/or destination address (and port numbers for TCP and
UDP)
The inbound network interface
Whether the packet is a TCP/IP connection request (a packet attempting to
initiate a TCP/IP session) or not
Whether the packet is a head, tail or intermediate IP fragment
Whether the packet has certain IP options defined or not
The MAC address of the destination station or of the source station
The figure below illustrates how packets are processed by the filtering mechanism
of the router:
Incoming filters
Outgoing filters
3
2
1
Incoming
packets
Packets addressed
to node 3
Packets starting
from node 1
Packets addressed
to node 2
Figure 48 - IP Firewall
There are two classes (sets) of filters - prohibiting (reject) and permitting (accept).
