71
Appendix A
– Firewall
STATEFUL PACKET INSPECTION
Refers to an architecture, where the firewall keeps track of packets on each
connection traversing all its interfaces and makes sure they are valid. This is in
contrast to static packet filtering which only examines a packet based on the
information in the packet header.
DENIAL OF SERVICE ATTACK
Is an incident in which a user or organization is deprived of the services of a
resource they would normally expect to have. Various DoS attacks the device can
withstand are ARP Attack, Ping Attack, Ping of Death, Land, SYN Attack, Smurf
Attack, and Tear Drop.
TCP/IP/PORT/INTERFACE FILTER
These rules help in the filtering of traffic at the Network layer (i.e. Layer 3).
When a Routing interface is created,
Enable Firewall
must be checked.
Navigate to Advanced Setup
Æ
Security
Æ
IP Filtering.
OUTGOING IP FILTER
Helps in setting rules to DROP packets from the LAN interface. By default, if the
Firewall is Enabled, all IP traffic from the LAN is allowed. By setting up one or more
filters, specific packet types coming from the LAN can be dropped.
Filter Name:
User defined Filter Name.
Protocol:
TCP/UDP, TCP, UDP, or ICMP
Source IP Address/Source Subnet Mask:
Packets with the specific "Source IP Address/Source Subnet Mask" combination
will be dropped.
Source Port:
This can take on either a single port number or a range of port
numbers. Packets having a source port equal to this value or falling within the
range of port numbers (portX : portY) will be dropped.
Destination IP Address/Destination Subnet Mask:
Packets with the
specific "Destination IP Address/Destination Subnet Mask" combination will be
dropped.
Destination Port:
This can take on either a single port number or a range
of port numbers. Packets having a destination port equal to this value or
falling within the range of port numbers (portX : portY) will be dropped.
Example 1:
Filter Name
: Out_Filter1
Protocol
:
TCP
Source Address
: 192.168.1.45
Source Subnet Mask
: 255.255.255.0
Source Port
: 80
Dest. Address
: NA
Dest. Subnet Mask
: NA
Dest. Port
: NA
This filter will Drop all TCP packets coming from the LAN with IP
Address/Subnet Mask of 192.168.1.45/24 having a source port of 80
irrespective of the destination. All other packets will be Accepted.
