![background image](http://html1.mh-extra.com/html/zyxel-communications/p-661h-series/p-661h-series_user-manual_944127152.webp)
P-661H/HW Series User’s Guide
152
Chapter 8 Firewalls
The previous figure shows the ZyXEL Device’s default firewall rules in action as well as
demonstrates how stateful inspection works. User A can initiate a Telnet session from within
the LAN and responses to this request are allowed. However other Telnet traffic initiated from
the WAN is blocked.
8.5.1 Stateful Inspection Process
In this example, the following sequence of events occurs when a TCP packet leaves the LAN
network through the firewall's WAN interface. The TCP packet is the first in a session, and the
packet's application layer protocol is configured for a firewall rule inspection:
1
The packet travels from the firewall's LAN to the WAN.
2
The packet is evaluated against the interface's existing outbound access list, and the
packet is permitted (a denied packet would simply be dropped at this point).
3
The packet is inspected by a firewall rule to determine and record information about the
state of the packet's connection. This information is recorded in a new state table entry
created for the new connection. If there is not a firewall rule for this packet and it is not an
attack, then the settings in the
Firewall General
screen determine the action for this
packet.
4
Based on the obtained state information, a firewall rule creates a temporary access list
entry that is inserted at the beginning of the WAN interface's inbound extended access
list. This temporary access list entry is designed to permit inbound packets of the same
connection as the outbound packet just inspected.
5
The outbound packet is forwarded out through the interface.
6
Later, an inbound packet reaches the interface. This packet is part of the connection
previously established with the outbound packet. The inbound packet is evaluated against
the inbound access list, and is permitted because of the temporary access list entry
previously created.
7
The packet is inspected by a firewall rule, and the connection's state table entry is updated
as necessary. Based on the updated state information, the inbound extended access list
temporary entries might be modified, in order to permit only packets that are valid for the
current state of the connection.
8
Any additional inbound or outbound packets that belong to the connection are inspected
to update the state table entry and to modify the temporary inbound access list entries as
required, and are forwarded through the interface.
9
When the connection terminates or times out, the connection's state table entry is deleted
and the connection's temporary inbound access list entries are deleted.
8.5.2 Stateful Inspection and the ZyXEL Device
Additional rules may be defined to extend or override the default rules. For example, a rule
may be created which will:
• Block all traffic of a certain type, such as IRC (Internet Relay Chat), from the LAN to the
Internet.
Summary of Contents for P-661H Series
Page 2: ......
Page 5: ...P 661H HW Series User s Guide Certifications 5...
Page 10: ...P 661H HW Series User s Guide 10 Customer Support...
Page 44: ...P 661H HW Series User s Guide 44 Chapter 1 Getting To Know Your ZyXEL Device...
Page 76: ...P 661H HW Series User s Guide 76 Chapter 3 Wizards...
Page 108: ...P 661H HW Series User s Guide 108 Chapter 5 LAN Setup...
Page 132: ...P 661H HW Series User s Guide 132 Chapter 6 Wireless LAN...
Page 192: ...P 661H HW Series User s Guide 192 Chapter 10 Trend Micro Security Services...
Page 196: ...P 661H HW Series User s Guide 196 Chapter 11 Content Filtering...
Page 202: ...P 661H HW Series User s Guide 202 Chapter 12 Introduction to IPSec...
Page 230: ...P 661H HW Series User s Guide 230 Chapter 13 VPN Screens...
Page 234: ...P 661H HW Series User s Guide 234 Chapter 14 Static Route...
Page 246: ...P 661H HW Series User s Guide 246 Chapter 15 Bandwidth Management...
Page 250: ...P 661H HW Series User s Guide 250 Chapter 16 Dynamic DNS Setup...
Page 280: ...P 661H HW Series User s Guide 280 Chapter 19 System...
Page 290: ...P 661H HW Series User s Guide 290 Chapter 21 Tools...
Page 296: ...P 661H HW Series User s Guide 296 Chapter 23 Troubleshooting...
Page 300: ...P 661H HW Series User s Guide 300 Appendix A...
Page 304: ...P 661H HW Series User s Guide 304 Appendix C...
Page 326: ...P 661H HW Series User s Guide 326 Appendix E...
Page 328: ...P 661H HW Series User s Guide 328 Appendix F...
Page 334: ...P 661H HW Series User s Guide 334 Appendix G...
Page 368: ...P 661H HW Series User s Guide 368 Appendix K...
Page 376: ...P 661H HW Series User s Guide 376 Figure 219 Java Sun...