ZyXEL Communications P-660HN-F1A, User Manual

Page: 224 / 430

Chapter 12 Packet Filter
P-660HN-F1A User’s Guide
224
12.3 Packet Filter Technical Reference
This section provides some technical background information about the topics
covered in this chapter.
12.3.1 Filter Types and NAT
There are two classes of filter rules, generic filter rules and protocol filter rules.
Generic filter rules act on the raw data from/to LAN and WAN. Protocol filter rules
act on the IP packets. When NAT (Network Address Translation) is enabled, the
inside IP address and port number are replaced on a connection-by-connection
basis, which makes it impossible to know the exact address and port on the wire.
Therefore, the P-660HN-F1A applies the protocol filters to the “native” IP address
and port number before NAT for outgoing packets and after NAT for incoming
packets. On the other hand, the generic filters are applied to the raw packets that
appear on the wire. They are applied at the point when the P-660HN-F1A is
receiving and sending the packets; that is the interface. The interface can be an
Ethernet port or any other hardware port. The following diagram illustrates this.
Figure 93 Protocol and Generic Filter Sets
12.3.2 Firewall Versus Filters
Below are some comparisons between the P-660HN-F1A’s filtering and firewall
functions.
Action Match Select the action for a matching packet.
Options are Check Next Rule, Forward and Drop.
Action Not Match Select the action for a packet not matching the rule.
Options are Check Next Rule, Forward and Drop.
Back Click this to return to the previous screen without saving.
Apply Click this to save your changes.
Cancel Click this to restore your previously saved settings.
Table 65 Security > Packet Filter > Edit (Generic Filter) > Edit Rule (continued)
LABEL DESCRIPTION
Protocol
Filters
Generic
Filters
NAT
Interface
Route
Incoming
Outgoing