Chapter 9 Firewalls
P-660HW-Dx User’s Guide
150
6
Later, an inbound packet reaches the interface. This packet is part of the connection
previously established with the outbound packet. The inbound packet is evaluated
against the inbound access list, and is permitted because of the temporary access list
entry previously created.
7
The packet is inspected by a firewall rule, and the connection's state table entry is
updated as necessary. Based on the updated state information, the inbound extended
access list temporary entries might be modified, in order to permit only packets that are
valid for the current state of the connection.
8
Any additional inbound or outbound packets that belong to the connection are inspected
to update the state table entry and to modify the temporary inbound access list entries as
required, and are forwarded through the interface.
9
When the connection terminates or times out, the connection's state table entry is deleted
and the connection's temporary inbound access list entries are deleted.
9.5.2 Stateful Inspection and the ZyXEL Device
Additional rules may be defined to extend or override the default rules. For example, a rule
may be created which will:
• Block all traffic of a certain type, such as IRC (Internet Relay Chat), from the LAN to the
Internet.
• Allow certain types of traffic from the Internet to specific hosts on the LAN.
• Allow access to a Web server to everyone but competitors.
• Restrict use of certain protocols, such as Telnet, to authorized users on the LAN.
These custom rules work by evaluating the network traffic’s Source IP address, Destination IP
address, IP protocol type, and comparing these to rules set by the administrator.
"
The ability to define firewall rules is a very powerful tool. Using custom rules, it
is possible to disable all firewall protection or block all access to the Internet.
Use extreme caution when creating or deleting firewall rules. Test changes after
creating them to make sure they work correctly.
Below is a brief technical description of how these connections are tracked. Connections may
either be defined by the upper protocols (for instance, TCP), or by the ZyXEL Device itself (as
with the "virtual connections" created for UDP and ICMP).
9.5.3 TCP Security
The ZyXEL Device uses state information embedded in TCP packets. The first packet of any
new connection has its SYN flag set and its ACK flag cleared; these are "initiation" packets.
All packets that do not have this flag structure are called "subsequent" packets, since they
represent data that occurs later in the TCP stream.
If an initiation packet originates on the WAN, this means that someone is trying to make a
connection from the Internet into the LAN. Except in a few special cases (see "Upper Layer
Protocols" shown next), these packets are dropped and logged.
Summary of Contents for P-660HW-DX
Page 2: ......
Page 7: ...Safety Warnings P 660HW Dx User s Guide 7...
Page 8: ...Safety Warnings P 660HW Dx User s Guide 8...
Page 10: ...Contents Overview P 660HW Dx User s Guide 10...
Page 20: ...Table of Contents P 660HW Dx User s Guide 20...
Page 26: ...List of Figures P 660HW Dx User s Guide 26...
Page 31: ...31 PART I Introduction Introducing the ZyXEL Device 33 Introducing the Web Configurator 37...
Page 32: ...32...
Page 50: ...Chapter 2 Introducing the Web Configurator P 660HW Dx User s Guide 50...
Page 51: ...51 PART II Wizards Wizard Setup for Internet Access 53 Bandwidth Management Wizard 67...
Page 52: ...52...
Page 66: ...Chapter 3 Wizard Setup for Internet Access P 660HW Dx User s Guide 66...
Page 72: ...Chapter 4 Bandwidth Management Wizard P 660HW Dx User s Guide 72...
Page 74: ...74...
Page 92: ...Chapter 5 WAN Setup P 660HW Dx User s Guide 92...
Page 141: ...141 PART IV Security Firewalls 143 Firewall Configuration 155 Content Filtering 177...
Page 142: ...142...
Page 162: ...Chapter 10 Firewall Configuration P 660HW Dx User s Guide 162 Figure 88 Firewall Edit Rule...
Page 176: ...Chapter 10 Firewall Configuration P 660HW Dx User s Guide 176...
Page 180: ...Chapter 11 Content Filtering P 660HW Dx User s Guide 180...
Page 182: ...182...
Page 186: ...Chapter 12 Static Route P 660HW Dx User s Guide 186...
Page 202: ...Chapter 14 Dynamic DNS Setup P 660HW Dx User s Guide 202...
Page 224: ...Chapter 16 Universal Plug and Play UPnP P 660HW Dx User s Guide 224...
Page 226: ...226...
Page 232: ...Chapter 17 System P 660HW Dx User s Guide 232...
Page 250: ...Chapter 18 Logs P 660HW Dx User s Guide 250...
Page 256: ...Chapter 19 Tools P 660HW Dx User s Guide 256...
Page 264: ...264...
Page 330: ...Appendix F Internal SPTGEN P 660HW Dx User s Guide 330...
Page 332: ...Appendix G Command Interpreter P 660HW Dx User s Guide 332...
Page 344: ...Appendix J Splitters and Microfilters P 660HW Dx User s Guide 344...
Page 350: ...Appendix L Legal Information P 660HW Dx User s Guide 350...
Page 356: ...Appendix M Customer Support P 660HW Dx User s Guide 356...
Page 364: ...Index P 660HW Dx User s Guide 364...
