Efficient Networks 5200 Series General Safety Guidelines, Firewall Security, Session Tracking

Page 11

SpeedStream Router User Guide

Firewall Security

The firewall in the SpeedStream router is a stateful packet inspection filter that works at the IP level. The firewall consists of an IP packet filtering mechanism, a Network Address Port Translator (NAPT), and a Network Address Translator (NAT). When the NAPT/NAT feature is enabled, the local (unreachable) IP addressing used in the LAN automatically protects it from access. Even when NAPT/NAT is disabled and the LAN is accessible from the WAN, you can configure the firewall to protect the LAN from external attacks by creating custom filters to fine-tune access control.

Note Firewall and NAPT/NAT are not the same thing; but a NAPT/NAT system works like a firewall and is often considered to be one. In the specific context of SpeedStream routers and their associated Web management interfaces, the term “firewall” refers to IP packet filtering (stateful inspection, etc.). However, in the generic sense of firewall functionality, SpeedStream products also include NAT and NAPT.

The firewall includes the following high-level, industry-standard features:

Port forwarding through NAPT/NAT.

Numerous Application Level Gateways (ALGs) for proper NAPT/NAT functioning.

Stateful IP filtering with sophisticated rules database.

Automatic and protocol-specific session tracking.

Preconfigured and custom firewall levels.

Virtual DMZ.

Firewall logging with Network Time Protocol and SysLog support.

Attack Detection System (ADS).

Session Tracking

Some protocols, such as FTP, require secondary network connections on ports other than the main control port. These connections are usually made using port numbers in the dynamic range (> 1024). The SpeedStream firewall allows traffic on such secondary sessions without manual configuration.

General Safety Guidelines

When using the SpeedStream router, observe the following safety guidelines:

Never install telephone wiring during a storm.

Avoid using a telephone during an electrical storm. Lightening increases the risk of electrical shock.

Do not install telephone jacks in wet locations and never use the product near water.

Do not exceed the maximum power load ratings for the product; otherwise, you risk dangerous overloading of the power circuit.

3

Image 11
Contents Router User Guide Software License General Provisions Contents Viewing Status Screens Iii 51-57 List of IllustrationsSpeedStream Router User Guide Hardware Description IntroductionAbout the SpeedStream Router Features and BenefitsSession Tracking General Safety GuidelinesFirewall Security Minimum System Requirements Installing the RouterHardware Installation Basic Installation ProcedureIn-Line Filter Installing Line FiltersRecording System Settings Two-to-One Adapter Connecting the CablesWall-Mount Filter Ethernet Installation Method USB Installation Method TCP/IP Properties dialog box displays Configuring Computer Network SettingsWindows 95 / 98 / ME TCP/IP Properties dialog box, click the IP Address tab Windows NT Double-clickNetwork and Dial-up Connections WindowsWindows XP Snooze Getting StartedNavigating the Web Interface LevelLog Screen Navigation ElementsIP Filter Rules To log on to the Web interface for the first time Logging On to the Web InterfaceLogging On to a PPP Session Entering the Network PasswordService Name Access ConcentratorHost Customizing Router SettingsTo specify the host configuration settings Click Save SettingsDhcp Configuration Options To specify the Dhcp configuration settings To change the user name or password User Setup System LoginStatic Routes Time Client Configuration OptionsTo configure the Time Client Time ClientNAT/NAPT Server To access the NAT/NAPT Configuration screenTo disable NAT and Napt To enable NAT and specify a destination IP addressPort Forwarding Port Forwarding Configuration OptionsTo enable Napt To add a port forwarding entry To edit an existing port forwarding configurationTo delete an existing entry To delete all entries in the tableFirewall Security Levels FirewallFirewall Snooze Control DMZ SettingsDMZ Configuration Options To enable DMZ and specify an accessible computer Cloning a Rule Definition To disable DMZOn the Firewall DMZ Configuration screen, click Disable DMZ Custom IP Filter RulesFill in the following information Firewall Simple Setup screenCustom IP Filter Configuration Creating Custom IP Filter RulesSpecify Destination Port Operator options Select a protocol to filterIf TCP/UDP chosen in , select the desired rule options Specify Source Port Operator optionsTypes of Attack BackgroundADS Configuration Options To filter, or drop, a packet type To enable ADSSelect Enable Attack Detection To save the new settingsRFC2684 RFC2684 Configuration OptionsTo configure RFC2684 settings UPnP Universal Plug and Play Bridge ModeUPnP Configuration Options To configure UPnP settingsRIP Routing Information Protocol RIP Configuration OptionsTo enable bridge mode System Log To configure RIP settingsLAN Servers To configure the System Log RebootSystem Log Configuration Options To update the router firmware ResetFirmware Update To reset the routerClick Run Diagnostics at the bottom of the screen DiagnosticsTo cancel the reset System Summary Viewing Status ScreensInterface Map Interface Map screen displays Interface MapFirewall Log To display the Interface MapTo display the System Log screen To update the displayStatus and Statistics Screens ATM/AAL Status/StatisticsEthernet Status/Statistics DSL Status/StatisticsRoutes USB Status/StatisticsInterpreting the LED Display TroubleshootingBasic Troubleshooting Steps Pwr LED Not Lit Resolving Specific IssuesContacting Technical Support Attack Detection System Configuration Data SheetsAdministrative User Setup Firewall Custom IP Filter Configuration Firewall DMZ Firewall Snooze Control Firewall LevelPPP Login Static Route RIPUPnP Technical Specifications Protocol Firewall Security LevelsNeed for Speed VNC Acronyms Acronyms and Technical ConceptsPPPoE Rx ErrorsMAC address OctetTechnical Concepts Dhcp Dynamic Host Configuration Protocol Icsa 3.0a-compliancy PPP Point-to-Point Protocol Index Data Sheets See Configuration Data Sheets PPP Network TCP