Nortel BSR252, Configuration - Basics

Page: 164 / 460

164 Chapter 10 Firewalls
NN47923-500
These custom rules work by evaluating the network traffic source IP address,
destination IP address, IP protocol type, and comparing these to rules set by the
administrator.
Below is a brief technical description of how these connections are tracked.
Connections can either be defined by the upper protocols (for instance, TCP), or
by the Business Secure Router itself (as with the virtual connections created for
UDP and ICMP).
TCP security
The Business Secure Router uses state information embedded in TCP packets.
The first packet of any new connection has its SYN flag set and its ACK flag
cleared; these are initiation packets. All packets that do not have this flag structure
are called subsequent packets, since they represent data that occurs later in the
TCP stream.
If an initiation packet originates on the WAN, someone is trying to make a
connection from the Internet into the LAN. Except in a few special cases, (see
“Upper layer protocols” on page 165 ), these packets are dropped and logged.
If an initiation packet originates on the LAN, someone is trying to make a
connection from the LAN to the Internet. Assuming that this is an acceptable part
of the security policy (as is the case with the default policy), the connection is
allowed. A cache entry is added, which includes connection information such as
IP addresses, TCP ports, and sequence numbers.
After the Business Secure Router receives any subsequent packet (from the
Internet or from the LAN), its connection information is extracted and checked
against the cache. A packet is only allowed to pass through if it corresponds to a
valid connection (that is, if it is a response to a connection that originated on the
LAN).
Note:
The ability to define firewall rules is a very powerful tool. Using
custom rules, it is possible to disable all firewall protection or block all
access to the Internet. Use extreme caution when creating or deleting
firewall rules. Test changes after creating them to make sure they work
correctly.