DGFV338 ProSafe Wireless ADSL Modem VPN Firewall Router Reference Manual
Security and Firewall Protection
4-19
v1.0, May 2008
•
Minimize-Delay
: Used when the time required for the packet to reach the destination must be
fast (low link latency). The IP packets for this service priority are marked with a TOS value of
8.
Attack Checks
This screen allows you to specify whether the DGFV338 should be protected against common
attacks from the LAN and WAN networks. The various types of attack checks are defined below.
Select the appropriate boxes to enable the required security measures.
•
WAN Security Checks
:
–
Respond To Ping On Internet Ports
—By default, the DGFV338 does not respond to an
ICMP Echo (ping) packet coming from the Internet or WAN side. We recommend that you
leave this option disabled to prevent hackers from easily discovering the DGFV338 via a
ping, but it can be enabled as a diagnostic tool for connectivity problems.
–
Enable Stealth Mode
—In stealth mode, the ProSafe DGFV338 will not respond to port
scans from the WAN or Internet, which makes it less susceptible to discovery and attacks.
–
Block TCP Flood
—A SYN flood is a form of denial of service attack in which an attacker
sends a succession of SYN requests to a target system. When the system responds, the
attacker doesn’t complete the connection, thus saturating the server with half-open
connections. No legitimate connections can then be made.
When blocking is enabled, the DGFV338 will limit the lifetime of partial connections and
will be protected from a SYN flood attack.
•
LAN Security Checks:
–
Block UDP flood—
A UDP flood is a form of denial of service attack in which the
attacking machine sends a large number of UDP packets to random ports to the victim
host. As a result, the victim host will check for the application listening at that port, see
that no application is listening at that port, and reply with an ICMP Destination
Unreachable packet.
When the victimized system is flooded, it is forced to send many ICMP packets,
eventually making it unreachable by other clients. The attacker may also spoof the IP
address of the UDP packets, ensuring that the excessive ICMP return packets do not reach
him, making the attacker’s network location anonymous.
Note:
A firewall rule that directs ICMP ping requests to a computer on the LAN
will override this option.
