Draytek VIGOR2910

Vigor2910 Series User’s Guide 47

Depending on whether there is an existing Internet connection, or in other words “the WAN

link status is up or down”, the IP filter architecture categorizes traffic into two: Call Filter

and Data Filter.

z Call Filter - When there is no existing Internet connection, Call Filter is applied to all

traffic, all of which should be outgoing. It will check packets according to the filter

rules. If legal, the packet will pass. Then the router shall “initiate a call” to build the

Internet connection and send the packet to Internet.

z Data Filter - When there is an existing Internet connection, Data Filter is applied to

incoming and outgoing traffic. It will check packets according to the filter rules. If legal,

the packet will pass the router.

The following illustrations are flow charts explaining how router will treat incoming traffic

and outgoing traffic respectively.

(

)

Stateful inspection is a firewall architecture that works at the network layer. Unlike legacy

static packet filtering, which examines a packet based on the information in its header,

stateful inspection builds up a state machine to track each connection traversing all interfaces

of the firewall and makes sure they are valid. The stateful firewall of Vigor router not just

examine the header information also monitor the state of the connection.