6-36 CHAPTER 6: MANUAL SETUP
For more details, re fer to the next two s ections. Assigning Filters discusses how
to decide where to apply a filter, and Applying Filters explains the appropriate
CLI commands to use.
Assigning Filters Once a filter has been added to router’s list of managed filters, you can assign it to
the unit’s:
Interfaces
VC / Remote Site Profile
Interface Filters You can configure interface filters for any interface. Interface filters control access
to all networks available for both modem a nd non-modem interfaces.
You can specify whether a filter applies to packets entering the interface (input
filter) or leaving the interface (output filter). The r o uter ex amines the fil ter ing r ules
to determine whether the interface accepts or rejects the packet.
Input Filter If an input filter is configured on an interface, all received packets are checked
against the filtering rules before being forwarded to another interface.
Output Filters If an output filter is configured on an interface, all outbound packets are checked
against the filtering rules before exiting the router.
Input Filters vs. Output
Filters When possible, use the input filter to fi lter an i ncomi ng pac ket rat her t ha n waiti ng
to catch a packet as it attempts to exit the router. This is recommended because:
A packet is prevented from entering the router, keeping potential intruders
from attacking the unit itself.
The routing engine does not waste time processing a packet t hat is going to b e
discarded anyway.
Most importantly, the router does not know which interface a n outgoing
packet came in through. If a potential intruder forges a packet with a false
source address (in order to appear as a trusted host or ne t work), there is no
way for an output filter to tell if that pa cket came in through the wrong
interface. An input filter, on the other hand, can filter out packets purporting
to be from networks that are actually connected to a different interface.
VC/Remote Site Filters You can configure filters for a specific VC / remote site profile that controls access
to the network for that location. This filter is only applied for the duration of the
remote network c onnection. As wit h interface filters , a remote site fil ter can be
configured to apply to input or output da ta traffic.
Applying Filters Using CLI You can apply filters to interfaces and/or users using the CLI. If you modify a file,
you need to re-assign it to make the changes take effect immediately. Otherwise
the changes will not take effect until the protocol network (IP, IPX, or bridge) that
the filter affects goes down and comes back up. This occurs when a network is
disabled, the WAN connection goes down then up, or when the OfficeConnect
Remote 812 is rebooted.