ZyXEL Communications P-324 User's Guide download pdf (Page 207)

P-2602HWNLI User’s Guide

Chapter 13 Firewalls 207

7 The packet is inspected by a firewall rule, and the connection's state table entry is updated

as necessary. Based on the updated state information, the inbound extended access list

temporary entries might be modified, in order to permit only packets that are valid for the

current state of the connection.

8 Any additional inbound or outbound packets that belong to the connection are inspected

to update the state table entry and to modify the temporary inbound access list entries as

required, and are forwarded through the interface.

9 When the connection terminates or times out, the connection's state table entry is deleted

and the connection's temporary inbound access list entries are deleted.

13.5.2 Stateful Inspection on Your ZyXEL Device

Additional rules may be defined to extend or override the default rules. For example, a rule

may be created which will:

• Block all traffic of a certain type, such as IRC (Internet Relay Chat), from the LAN to the

Internet.

• Allow certain types of traffic from the Internet to specific hosts on the LAN.

• Allow access to a Web server to everyone but competitors.

• Restrict use of certain protocols, such as Telnet, to authorized users on the LAN.

These custom rules work by evaluating the network traffic’s Source IP address, Destination IP

address, IP protocol type, and comparing these to rules set by the administrator.

Note: The ability to define firewall rules is a very powerful tool. Using custom rules, it

is possible to disable all firewall protection or block all access to the Internet.

Use extreme caution when creating or deleting firewall rules. Test changes after

creating them to make sure they work correctly.

Below is a brief technical description of how these connections are tracked. Connections may

either be defined by the upper protocols (for instance, TCP), or by the ZyXEL Device itself (as

with the "virtual connections" created for UDP and ICMP).

13.5.3 TCP Security

The ZyXEL Device uses state information embedded in TCP packets. The first packet of any

new connection has its SYN flag set and its ACK flag cleared; these are "initiation" packets.

All packets that do not have this flag structure are called "subsequent" packets, since they

represent data that occurs later in the TCP stream.

If an initiation packet originates on the WAN, this means that someone is trying to make a

connection from the Internet into the LAN. Except in a few special cases (see "Upper Layer

Protocols" shown next), these packets are dropped and logged.

1 2 ... 202 203 204 205 206 207 208 209 210 211 212 ... 441 442

No comments

ZyXEL Communications P-324 User's Guide Page 207