Firewall Tab
The following table lists the attacks for which the gateway firewall filters continuously check.
Attack | Description and Action Taken |
Excessive Session Detection | When enabled, the firewall will detect applications on the |
| local network that are creating excessive sessions out to |
| the Internet. This activity is likely due to a virus or “worm” |
| infected computer (for example, Blaster Worm). When the |
| event is detected, the gateway displays a HURL warning |
| page. |
TCP/UDP Port Scan | A port scan is a series of messages sent by someone |
| attempting to break into a computer to learn which |
| computer network services, each associated with a well- |
| known port number (such as UDP and TCP), the computer |
| provides. When enabled, the firewall detects UDP and TCP |
| port scans, and drops the packet. |
Invalid Source/Destination IP | When enabled, the firewall will verify IP addresses by |
address | checking for the following: |
| IP source address is broadcast or multicast — drop |
| packet. |
| TCP destination IP address is not unicast — drop packet. |
| IP source and destination address are the same — drop |
| packet. |
| Invalid IP source received from private/home network — |
| drop packet. |
Packet Flood (SYN/UDP/ICMP/ | When enabled, the firewall will check for SYN, UDP, ICMP, |
Other) | and other types of packet floods on the local and Internet |
| facing interfaces and stop the flood. |
Invalid TCP Flag Attacks (NULL/ | When enabled, the firewall will scan inbound and |
XMAS/Other) | outbound packets for invalid TCP Flag settings, and drop |
| the packet to prevent SYN/FIN, NULL, and XMAS attacks. |
Invalid ICMP Detection | The firewall checks for invalid ICMP/code types, and drops |
| the packet. |
Miscellaneous | The firewall checks for the following: |
| Unknown IP protocol — drop packet. |
| Port 0 attack detected — drop packet. |
| TCP SYN packet — drop packet. |
| Not a start session packet — drop packet. |
| ICMP destination unreachable — terminate session. |
To disable attack detection for a specific port:
•Open a Web browser and access the 2Wire gateway user interface by entering http://gateway.2wire.net.
•Click the Firewall tab.
56
