ZyWALL 70 User’s Guide
176
Chapter 9 Firewalls
If an initiation packet originates on the LAN, this means that someone is trying to make a
connection from the LAN to the Internet. Assuming that this is an acceptable part of the
security policy (as is the case with the default policy), the connection will be allowed. A cache
entry is added which includes connection information such as IP addresses, TCP ports,
sequence numbers, etc.
When the ZyWALL receives any subsequent packet (from the Internet or from the LAN), its
connection information is extracted and checked against the cache. A packet is only allowed to
pass through if it corresponds to a valid connection (that is, if it is a response to a connection
which originated on the LAN).
9.5.4 UDP/ICMP Security
UDP and ICMP do not themselves contain any connection information (such as sequence
numbers). However, at the very minimum, they contain an IP address pair (source and
destination). UDP also contains port pairs, and ICMP has type and code information. All of
this data can be analyzed in order to build "virtual connections" in the cache.
For instance, any UDP packet that originates on the LAN will create a cache entry. Its IP
address and port pairs will be stored. For a short period of time, UDP packets from the WAN
that have matching IP and UDP information will be allowed back in through the firewall.
A similar situation exists for ICMP, except that the ZyWALL is even more restrictive.
Specifically, only outgoing echoes will allow incoming echo replies, outgoing address mask
requests will allow incoming address mask replies, and outgoing timestamp requests will
allow incoming timestamp replies. No other ICMP packets are allowed in through the firewall,
simply because they are too dangerous and contain too little tracking information. For
instance, ICMP redirect packets are never allowed in, since they could be used to reroute
traffic through attacking machines.
9.5.5 Upper Layer Protocols
Some higher layer protocols (such as FTP and RealAudio) utilize multiple network
connections simultaneously. In general terms, they usually have a "control connection" which
is used for sending commands between endpoints, and then "data connections" which are used
for transmitting bulk information.
Consider the FTP protocol. A user on the LAN opens a control connection to a server on the
Internet and requests a file. At this point, the remote server will open a data connection from
the Internet. For FTP to work properly, this connection must be allowed to pass through even
though a connection from the Internet would normally be rejected.
In order to achieve this, the ZyWALL inspects the application-level FTP data. Specifically, it
searches for outgoing "PORT" commands, and when it sees these; it adds a cache entry for the
anticipated data connection. This can be done safely, since the PORT command contains
address and port information, which can be used to uniquely identify the connection.
Содержание ZyWALL 70
Страница 1: ...ZyWALL 70 Internet Security Appliance User s Guide Version 3 64 3 2005 ...
Страница 2: ......
Страница 38: ...ZyWALL 70 User s Guide 38 List of Figures ...
Страница 46: ...ZyWALL 70 User s Guide 46 List of Tables ...
Страница 74: ...ZyWALL 70 User s Guide 74 Chapter 2 Introducing the Web Configurator ...
Страница 92: ...ZyWALL 70 User s Guide 92 Chapter 3 Wizard Setup ...
Страница 102: ...ZyWALL 70 User s Guide 102 Chapter 4 LAN Screens ...
Страница 108: ...ZyWALL 70 User s Guide 108 Chapter 5 Bridge Screens ...
Страница 130: ...ZyWALL 70 User s Guide 130 Chapter 6 Wireless LAN ...
Страница 136: ...ZyWALL 70 User s Guide 136 Chapter 7 WAN Screens Figure 45 WAN General ...
Страница 155: ...ZyWALL 70 User s Guide Chapter 7 WAN Screens 155 Figure 55 Dial Backup Setup ...
Страница 188: ...ZyWALL 70 User s Guide 188 Chapter 10 Firewall Screens Figure 71 Creating Editing A Firewall Rule ...
Страница 193: ...ZyWALL 70 User s Guide Chapter 10 Firewall Screens 193 Figure 76 My Service Rule Configuration ...
Страница 234: ...ZyWALL 70 User s Guide 234 Chapter 13 Introduction to IPSec ...
Страница 246: ...ZyWALL 70 User s Guide 246 Chapter 14 VPN Screens Figure 112 VPN Rules IKE Gateway Policy Edit ...
Страница 252: ...ZyWALL 70 User s Guide 252 Chapter 14 VPN Screens Figure 113 VPN Rules IKE Network Policy Edit ...
Страница 275: ...ZyWALL 70 User s Guide Chapter 15 Certificates 275 Figure 125 My Certificate Details ...
Страница 294: ...ZyWALL 70 User s Guide 294 Chapter 16 Authentication Server Figure 136 Local User Database ...
Страница 314: ...ZyWALL 70 User s Guide 314 Chapter 17 Network Address Translation NAT ...
Страница 318: ...ZyWALL 70 User s Guide 318 Chapter 18 Static Route ...
Страница 324: ...ZyWALL 70 User s Guide 324 Chapter 19 Policy Route ...
Страница 340: ...ZyWALL 70 User s Guide 340 Chapter 20 Bandwidth Management ...
Страница 376: ...ZyWALL 70 User s Guide 376 Chapter 22 Remote Management ...
Страница 390: ...ZyWALL 70 User s Guide 390 Chapter 24 Logs Screens Figure 194 Log Settings ...
Страница 413: ...ZyWALL 70 User s Guide Chapter 25 Maintenance 413 Figure 216 Restart Screen ...
Страница 414: ...ZyWALL 70 User s Guide 414 Chapter 25 Maintenance ...
Страница 440: ...ZyWALL 70 User s Guide 440 Chapter 28 WAN and Dial Backup Setup ...
Страница 456: ...ZyWALL 70 User s Guide 456 Chapter 31 DMZ Setup ...
Страница 460: ...ZyWALL 70 User s Guide 460 Chapter 32 Route Setup ...
Страница 470: ...ZyWALL 70 User s Guide 470 Chapter 33 Remote Node Setup ...
Страница 522: ...ZyWALL 70 User s Guide 522 Chapter 39 System Information Diagnosis ...
Страница 538: ...ZyWALL 70 User s Guide 538 Chapter 40 Firmware and Configuration File Maintenance ...
Страница 550: ...ZyWALL 70 User s Guide 550 Chapter 42 Remote Management ...
Страница 558: ...ZyWALL 70 User s Guide 558 Chapter 43 IP Policy Routing ...
Страница 573: ...ZyWALL 70 User s Guide Chapter 45 Troubleshooting 573 Figure 360 Java Sun ...
Страница 574: ...ZyWALL 70 User s Guide 574 Chapter 45 Troubleshooting ...
Страница 582: ...ZyWALL 70 User s Guide 582 Appendix B Removing and Installing a Fuse ...
Страница 602: ...ZyWALL 70 User s Guide 602 Appendix D IP Subnetting ...
Страница 608: ...ZyWALL 70 User s Guide 608 Appendix F PPTP ...
Страница 626: ...ZyWALL 70 User s Guide 626 Appendix H Triangle Route ...
Страница 656: ...ZyWALL 70 User s Guide 656 Appendix K Importing Certificates ...
Страница 658: ...ZyWALL 70 User s Guide 658 Appendix L Command Interpreter ...
Страница 664: ...ZyWALL 70 User s Guide 664 Appendix M Firewall Commands ...
Страница 668: ...ZyWALL 70 User s Guide 668 Appendix N NetBIOS Filter Commands ...
Страница 674: ...ZyWALL 70 User s Guide 674 Appendix P Brute Force Password Guessing Protection ...
Страница 696: ...ZyWALL 70 User s Guide 696 Appendix R Log Descriptions ...