Firewall Protection
136
ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308
Whether or not DHCP is enabled, how the computer accesses the server’s LAN address
impacts the inbound rules. For example:
•If your external IP address is assigned dynamically by your ISP (DHCP enabled), the IP
address might change periodically as the DHCP lease expires. Consider using Dynamic
DNS so that external users can always find your network (see Configure Dynamic DNS
on page 48).
•If the IP address of the local server computer is assigned by DHCP, it might change when
the computer is rebooted. To avoid this, use the Reserved (DHCP Client) feature in the
LAN Groups screen to keep the computer’s IP address constant (see Set Up DHCP
Address Reservation on page 96).
•Local computers need to access the local server using the computers’ local LAN address.
Attempts by local computers to access the server using the external WAN IP address will
fail.
Note: See Configure Port Triggering on page 192 for yet another way to
allow certain types of inbound traffic that would otherwise be blocked
by the firewall.
Note: The VPN firewall always blocks denial of service (DoS) attacks. A
DoS attack does not attempt to steal data or damage your
computers, but overloads your Internet connection so you cannot
use it (that is, the service becomes unavailable).
Note: When the Block TCP Flood and Block UDP Flood check boxes are
selected on the Attack Checks screen (which they are by default;
see Attack Checks on page 166), multiple concurrent connections of
the same application from one host or IP address (such as multiple
DNS queries from one computer) trigger the VPN firewall’s DoS
protection.
The following table describes the fields that define the rules for inbound traffic and that are
common to most Inbound Service screens (see Figure 76 on page 145, Figure 82 on
page 152, and Figure 88 on page 158).
The steps to configure inbound rules are described in the following sections:
•Configure LAN WAN Rules
•Configure DMZ WAN Rules
•Configure LAN DMZ Rules