Security
Established connections
The TCP header contains one bit called the ACK bit (or TCP Ack bit). This ACK bit appears only with TCP, not UDP. The ACK bit is part of the TCP mechanism that guarantees the delivery of data. The ACK bit is set whenever one side of a connection has received data from the other side. Only the first TCP packet will not have the ACK bit set; once the TCP connection is in place, the remainder of the TCP packets with have the ACK bit set.
The ACK bit is helpful for firewall design and reduces the number of potential filter rules. A filter rule could be created just allowing incoming TCP packets with the ACK bit set, since these packets had to be originated from the local network.
Example filter set screen
This is an example of the Motorola Netopia® filter set screen:
Change Input Filter 1
Enabled: | Yes |
Forward: | No |
Source IP Address: | 0.0.0.0 |
Source IP Address Mask: | 0.0.0.0 |
Dest. IP Address: | 0.0.0.0 |
Dest. IP Address Mask: | 0.0.0.0 |
Protocol Type: | TCP |
Source Port Compare... | No Compare |
Source Port ID: | 0 |
Dest. Port Compare... | Equal |
Dest. Port ID: | 2000 |
Established TCP Conns. Only: | No |
Filter basics
In the source or destination IP address fields, the IP address that is entered must be the network address of the subnet. A host address can be entered, but the applied subnet mask must be 32 bits (255.255.255.255).
The Motorola Netopia® Embedded Software Version 8.7.4 has the ability to compare source and destination TCP or UDP ports. These options are as follows:
Item | What it means |
|
|
No Compare | Does not compare TCP or UDP port |
|
|
Not Equal To | Matches any port other than what is defined |
|
|
Less Than | Anything less than the port defined |
|
|
