Netopia R7200 manual ﬁltering rule, Parts of a ﬁlter, Port numbers

Page 157

Security 14-7

A ﬁltering rule

The criteria are based on information contained in the packets. A ﬁlter is simply a rule that prescribes certain actions based on certain conditions. For example, the following rule qualiﬁes as a ﬁlter:

Block all Telnet attempts that originate from the remote host 199.211.211.17.

This rule applies to Telnet packets that come from a host with the IP address 199.211.211.17. If a match occurs, the packet is blocked.

Here is what this rule looks like when implemented as a ﬁlter on the Netopia R7200:

+-#--	Source IP Addr--	Dest IP Addr-----	Proto-Src.Port-D.Port--	On?-Fwd-+
+--------------------------------------------------------------------				+
1	199.211.211.17	0.0.0.0	TCP 23	Yes No
+--------------------------------------------------------------------				+

To understand this particular ﬁlter, look at the parts of a ﬁlter.

Parts of a ﬁlter

A ﬁlter consists of criteria based on packet attributes. A typical ﬁlter can match a packet on any one of the following attributes:

■The source IP address (where the packet was sent from)

■The destination IP address (where the packet is going)

■The type of higher-layer Internet protocol the packet is carrying, such as TCP or UDP

Port numbers

A ﬁlter can also match a packet’s port number attributes, but only if the ﬁlter’s protocol type is set to TCP or UDP, since only those protocols use port numbers. The ﬁlter can be conﬁgured to match the following:

■The source port number (the port on the sending host that originated the packet)

■The destination port number (the port on the receiving host that the packet is destined for)

By matching on a port number, a ﬁlter can be applied to selected TCP or UDP services, such as Telnet, FTP, and World Wide Web. The following tables show a few common services and their associated port numbers:

Internet service	TCP port	Internet service	TCP port


FTP	20/21	Finger	79

Telnet	23	World Wide Web	80

SMTP (mail)	25	News	144

Gopher	70	rlogin	513

Image 157

Contents Netopia R7200 Sdsl Router Part Number Contents Part II Advanced Configuration Contents Aurp Snmp Xmodem Part III Appendixes User’s Reference Guide Part I Getting Started User’s Reference Guide Chapter Introduction Features and capabilitiesOverview How to use this guide Finding an Internet service provider Chapter Setting Up Internet ServicesUnique requirements Setting up a Netopia R7200 account Obtaining an IP addressPricing and support Endorsements Deciding on an ISP accountLocal LAN IP address information to obtain Obtaining information from the ISPWith Network Address Translation Without Network Address TranslationUser’s Reference Guide Find a location Chapter Making the Physical ConnectionsWhat you need Identify the connectors and attach the cablesYour router on Netopia R7200 Sdsl Router back panel portsNetopia R7200 LED front panel Netopia R7200 Sdsl Router status lightsReadying computers on your local network Chapter Connecting to Your Local Area NetworkUser’s Reference Guide Connecting to an Ethernet network 10Base-T Adding an external modem Connecting to a LocalTalk network Chapter Setting up your Router with the SmartStart Wizard Before running SmartStart SmartStart Wizard conﬁguration screens Setting up your Router with the SmartStart WizardEasy option Advanced setupAdvanced option Conﬁguration screen on Conﬁguration tab Dynamic conﬁguration recommendedStatic conﬁguration optional Add. Repeat this process for the secondary DNS TCP/IP Conﬁguring TCP/IP on Macintosh computersTCP/IP or MacTCP Dynamic conﬁguration using MacIP optional Setting up your Router with the SmartStart Wizard User’s Reference Guide Chapter Console-Based Management Connecting through a Telnet session Conﬁguring Telnet software Connecting a console cable to your routerPC ANSI-BBS Navigating through the console screensEasy Setup console screens Chapter Easy SetupAccessing the Easy Setup console screens See Appendix A, Troubleshooting, for more suggestions Quick Easy Setup connection path Main Menu appears Sdsl Line ConﬁgurationPrevious Screen Next Screen Easy Setup ProﬁleIP Easy Setup Easy Setup Security Conﬁguration Previous Screen To Main Menu Part II Advanced Configuration User’s Reference Guide WAN conﬁguration Chapter WAN and System ConfigurationATM VPI ATM VCI Creating a new Connection Proﬁle IPX Profile Parameters Remote IPX Network Datalink PPP/MP Options Data Compression Default proﬁle Main Menu Default Proﬁle screen appears IP parameters default proﬁle screen System conﬁguration screens IPX parameters default proﬁle screenNavigating through the system conﬁguration screens System conﬁguration features Filter sets ﬁrewalls Network protocols setupIP address serving Date and timeConsole conﬁguration Snmp Simple Network Management Protocol Upgrade feature setSecurity LoggingInstalling the Syslog client User’s Reference Guide Chapter Line Backup Backup Conﬁguration screen appears Atdt Backup Conﬁguration screenIP Setup screen Connection Proﬁles Using Scheduled Connections with BackupScheduled Connections screen appears Management/Statistics Force Recovery Event Logs QuickViewSnmp Support User’s Reference Guide Network Address Translation features Chapter IP Setup and Network Address TranslationHOW NAT Works Previous Screen Using Network Address TranslationV2 multicast Numbered Sdsl WAN1 Associating port numbers with nodesAdvanced IP/IPX router conﬁguration options Data Link Options IP Setup and Network Address Translation Network Address Translation guidelines IP setup User’s Reference Guide Select Add Export. The Add Exported Service screen appears Select Service. a pop-up menu of services and ports appears IP subnets User’s Reference Guide Static routes Viewing static routes Static Routes screen will appearAdding a static route Modifying a static route Rules of static route installationDeleting a static route Main Menu System Configuration IP Address Serving 176.163.222.10 Dhcp NetBios Options Serve Bootp Clients IP Address Pools IP Setup and Network Address Translation Dhcp NetBIOS Options NetBios Type MacIP KIP forwarding setup You have ﬁnished your IP setup User’s Reference Guide IPX features Chapter IPX SetupIPX deﬁnitions Internetwork Packet Exchange IPXIPX address Service Advertising Protocol SAPSocket Routing Information Protocol RIPIPX setup screen NetBIOSIPX spooﬁng Default Gateway Address IPX routing tables User’s Reference Guide AppleTalk networks Chapter AppleTalk SetupAppleTalk protocol AT Routing Table Routers and seeding MacIPInstalling AppleTalk Upgrade Feature Set Conﬁguring AppleTalk EtherTalk setupLocalTalk setup Viewing Aurp partners Aurp setupAurp Free Trade Zone Modifying an Aurp partner Adding an Aurp partnerReceiving Aurp connections Deleting an Aurp partnerConﬁguring Aurp Options Aurp Options Tickle Interval Hhmmss User’s Reference Guide Quick View status overview Chapter Monitoring ToolsGeneral status Status lights Current statusGeneral Statistics Statistics & LogsPhysical Interface Event historiesNetwork Interface WAN Event History Device Event History Routing tablesIP routing table IPX Sap Bindery table IPX routing tableAppleTalk routing table Served IP Addresses IP Address Lease Management screen appears Snmp System InformationCommunity strings Snmp Setup screenSnmp traps Viewing IP trap receivers Setting the IP trap receiversModifying IP trap receivers Deleting IP trap receiversWeb-based management pages Event History pages WAN Event History Device Event History User’s Reference Guide Suggested security measures Chapter SecurityUser accounts Protecting the conﬁguration screens Protecting the Security Options screenDial-in console access Telnet access Enable SmartStart/SmartView/Web serverAbout ﬁlters and ﬁlter sets What’s a ﬁlter and what’s a ﬁlter set?Filter priority How ﬁlter sets workHow individual ﬁlters work Parts of a ﬁlter ﬁltering rulePort numbers Other ﬁlter attributes Port number comparisonsUDP Putting the parts togetherFiltering example #2 Filtering example #1Disadvantages of ﬁlters Design guidelinesWorking with IP ﬁlters and ﬁlter sets An approach to using ﬁltersNaming a new ﬁlter set Adding a ﬁlter setAdding ﬁlters to a ﬁlter set Input and output ﬁlters-source and destinationADD this Filter NOW Cancel Viewing ﬁlters Viewing ﬁlter setsModifying ﬁlters Deleting ﬁltersDeleting a ﬁlter set Modifying ﬁlter setsSample IP ﬁlter set TCP Icmp UDP Possible modiﬁcations User’s Reference Guide IPX ﬁlters Viewing and modifying packet ﬁlters IPX packet ﬁltersAdding a packet ﬁlter Deleting a packet ﬁlter IPX packet ﬁlter setsViewing and modifying packet ﬁlter sets Adding a packet ﬁlter setNo Match Deleting a packet ﬁlter set IPX SAP ﬁltersViewing and modifying SAP ﬁlters Deleting a SAP ﬁlter Adding a SAP ﬁlterViewing and modifying SAP ﬁlter sets IPX SAP ﬁlter setsAdding a SAP ﬁlter set Deleting a SAP ﬁlter set Basic IP packet components Firewall tutorial General ﬁrewall termsBasic protocol types Example TCP/UDP Ports Firewall design rulesFirewall Logic Logical and function Binary representationEstablished connections Implied rulesExample IP ﬁlter set screen Example network Filter basicsExample Example ﬁltersExample Example Chapter Utilities and Diagnostics Ping Receive return Ping packet Stop Ping Trace RouteTelnet client Disconnect Telnet console session Factory defaultsUpdating ﬁrmware Transferring conﬁguration and ﬁrmware ﬁles with TftpDownloading conﬁguration ﬁles Transferring conﬁguration and ﬁrmware ﬁles with Xmodem Uploading conﬁguration ﬁlesIdle Do you want to send a saved configuration to your Netopia? Restarting the system Part III Appendixes User’s Reference Guide Conﬁguration problems Appendix a TroubleshootingNetwork problems Console connection problemsPower outages How to reset the router to factory defaultsTechnical support How to reach usBefore contacting Netopia Environment proﬁleFAX-Back Online product informationUser’s Reference Guide Appendix B Understanding IP Addressing What is IP?About IP addressing Subnets and subnet masks Subnet masks Example Using subnets on a Class C IP internetISP Network Network conﬁgurationDistributing IP addresses Example Working with a Class C subnetBackground Technical note on subnet masking Conﬁguration Netopia R7200 Dhcp server characteristicsDhcp address serving Manually distributing IP addresses Using address servingMacIP serving Serve dynamic WAN clientsUnderstanding IP Addressing B-9 Tips and rules for distributing IP addressesDhcp example Internet Nested IP subnets0.0 C.1 WAN 3719 Packet header types BroadcastsUser’s Reference Guide Network conﬁguration Appendix C Understanding Netopia NAT BehaviorBackground User’s Reference Guide Understanding Netopia NAT Behavior C-3 Netopia Router WWW Server ISP Router LAN Understanding Netopia NAT Behavior C-5 Exported servicesImportant notes Understanding Netopia NAT Behavior C-7 Summary Appendix D Binary Conversion Table Decimal Binary Appendix E Further Reading User’s Reference Guide Further Reading E-3 User’s Reference Guide Pinouts for Auxiliary port modem cable Appendix F Technical Specifications and Safety InformationDescription Power requirementsEnvironment Software and protocols Regulatory notices Agency approvalsNorth America InternationalDeclaration for Canadian users Important safety instructionsBattery Telecommunication installation cautionsAppendix G About Sdsl User’s Reference Guide Glossary User’s Reference Guide Glossary User’s Reference Guide Remapping See network number remapping User’s Reference Guide Glossary User’s Reference Guide Numerics IndexIndex-2 Index-3 Index-4 Index-5 Index-6 Limited Warranty and Limitation of Remedies User’s Reference Guide