ISDN Router Manual V.1.1
34
•
IP, ICMP, TCP, UDP
•
It can reject the above traffic from a certain machine given its IP address
•
It can reject the above traffic on a certain port. This is useful because one can configure
firewall to selectively reject Telnet, Ftp, IRC, News, Web surfing, etc.
Let us try to answer this question by picking up an example, hopefully this example can help you to
understand the steps required in configuring a firewall better.
Let‘s say you want to configure firewall to disallow someone on the internet to
telnet
into the
company computers on the LAN. Since we know that telnet always use TCP port #23, we will
configure the router to deny any TCP traffic on this port. The commands are as follow:
Enter the rule for denying TCP traffic on port #23
>
config firewall add deny tcp from any to any:23 via isdn
By default, firewall will be off. When it is turned on, all traffic will be denied. After that you can
add in your own rules to selectively let some or all of the traffic to go through the router.
The firewall also allows you to add new rule in between existing rules. For example if there are
two existing rules with index number 100 and 200, then we can add a new rule in between those
two rules:
>config fire add 150 allow ip from any to any
then this rule will be placed between 100 and 200.
config ip nat add isdn
The NAT configuration has been separated from the firewall configuration. That is if the
firewall is not turned on, then in order to have NAT you must enter the command.
The router has the capability to perform IP routing with the addition of
changing
the IP
address in the packets on the fly, i.e. as the data is passed through from the LAN to the
Internet. In router this feature is called
Network Address Translation
(
NAT
)
. It allows
multiple machines connected to a LAN access the Internet through only 1 IP address. For
this reason routers with NAT are also called
IP Share
devices.
Configuring NAT on the router is easy. When the connection has been established with the
Internet, enter the following command:
