Kerio Tech Firewall6 manual Special Security Settings, Anti-Spoofing, Connections Count Limit, 217

15.2 Special Security Settings

Anti-Spoofing

Anti-Spoofingchecks whether only packets with allowed source IP addresses are received at individual interfaces of the WinRoute host. This function protects WinRoute host from attacks from the internal network that use false IP addresses (so called spoofing).

For each interface, any source IP address belonging to any network connected to the interface is correct (either directly or using other routers). For any interface connected to the Internet (so called external interface), any IP address which is not allowed at any other interface is correct.

Detailed information on networks connected to individual interfaces is acquired in the routing table.

The Anti-Spoofingfunction can be configured in the Anti-Spoofingfolder in Configuration / Advanced Options.

Enable Anti-Spoofing

This option activates Anti-Spoofing.

Log

If this option is on, all packets that have not passed the anti-spoofing rules will be logged in the Security log (for details see chapter 20.11).

Connections Count Limit

This function defines a limit for the maximum number of connections per a local host. This function can be enabled/disabled and set through the Security Settings tab in Con- figuration → Advanced Options.

This function can be helpful especially for the following cases:

•Any service (e.g. WWW server) which is available from the Internet (allowed by traf- fic rules —see chapter 6) is running on the local network. Connection count limits protect internal servers from flooding (DoS type attacks — Denial of Service).

In this case, the limit is applied to the local server — sum of all connections of all connected clients must not exceed this limit.

•Client computer (workstation) in the local network is attacked by a worm or a Trojan horse which is trying to establish a connection to many servers. Connection count limits protects the WinRoute host from flooding and it can reduce undesirable activi- ties by worms and Trojan horses.

In this case, the limit is applied to a host (workstation) in the local network — the sum of all connections established from this computer to individual servers in the Internet must not exceed the limit.

217