Possible modiﬁcations | Netopia R2020 specs

Security 14-19

Basic Firewall is suitable for a LAN containing only client hosts that wish to access servers on the WAN, not for a LAN containing servers providing services to clients on the WAN. Basic Firewall’s general strategy is to explicitly pass WAN-originated TCP and UDP trafﬁc to ports greater than 1023. Ports lower than 1024 are the service origination ports for various Internet services such as FTP, Telnet, and the World Wide Web (WWW).

A more complicated ﬁlter set would be required to provide WAN access to a LAN-based server. See “Possible modiﬁcations,” below, for ways to allow remote hosts to use services provided by servers on the LAN.

Possible modiﬁcations

You can modify the sample ﬁlter set Basic Firewall to allow incoming trafﬁc using the examples below. These modiﬁcations are not intended to be combined. Each modiﬁcation is to be the only one used with Basic Firewall.

The results of combining ﬁlter set modiﬁcations can be difﬁcult to predict. It is recommended that you take special care if making more than one modiﬁcation to the sample ﬁlter set.

Trusted host. To allow unlimited access by a trusted remote host with the IP address a.b.c.d (corresponding to a numbered IP address such as 163.176.8.243), insert the following input ﬁlter ahead of the current input ﬁlter 1:

■Enabled: Yes

■Forward: Yes

■Source IP Address: a.b.c.d

■Source IP Address Mask: 255.255.255.255

■Dest. IP Address: 0.0.0.0

■Dest. IP Address Mask: 0.0.0.0

■Protocol Type: 0

Trusted subnet. To allow unlimited access by a trusted remote subnet with subnet address a.b.c.d (corresponding to a numbered IP address such as 163.176.8.0) and subnet mask e.f.g.h (corresponding to a numbered IP mask such as 255.255.255.0), insert the following input ﬁlter ahead of the current input ﬁlter 1:

■Enabled: Yes

■Forward: Yes

■Source IP Address: a.b.c.d

■Source IP Address Mask: e.f.g.h

■Dest. IP Address: 0.0.0.0

■Dest. IP Address Mask: 0.0.0.0

■Protocol Type: 0

Image 223

Netopia R2020 manual Possible modiﬁcations

Contents

Netopia¨ R2020 Dual Analog Router Part Number Contents Part II Advanced Configuration Contents Multiple Network Address Translation and IP Setup Aurp Snmp Contents Part III Appendixes Contents User’s Reference Guide Page Small Ofﬁce connection to the Internet Small Ofﬁce connection to the Internet Direct Connection to a Corporate Ofﬁce Telecommuter Conﬁgured to accept incoming dial-up connections Page Part I Getting Started User’s Reference Guide Chapter Introduction Features and capabilitiesOverview How to use this guide Find a location Chapter Making the Physical ConnectionsWhat you need Ethernet Telco Identify the connectors and attach the cables Telco Line ports Netopia R2020 Dual Analog Router Back Panel Ports Making the Physical Connections Netopia R2020 LED front panel Netopia R2020 Dual Analog Router Status Lights Installed and properly conﬁgured. See Chapter Setting up your Router with the SmartStart WizardBefore running SmartStart User’s Reference Guide SmartStart Wizard conﬁguration screens Setting up your Router with the SmartStart Wizard Easy or Advanced options screen. You can choose either Easy option Setting up your Router with the SmartStart Wizard User’s Reference Guide Setting up your Router with the SmartStart Wizard Advanced option Dynamic conﬁguration recommended Conﬁguration tab Static conﬁguration optional Add. Repeat this process for the secondary DNS TCP/IP Conﬁguring TCP/IP on Macintosh computers TCP/IP or MacTCP Dynamic conﬁguration using MacIP optional User’s Reference Guide Readying computers on your local network Chapter Connecting Your Local Area Network User’s Reference Guide 10Base-T Connecting to an Ethernet network Adding an external modem Connecting to a LocalTalk network Wiring guidelines for PhoneNET cabling Chapter Console-based Management Snmp Simple Network Management Protocol. See Snmp on Connecting through a Telnet session Conﬁguring Telnet software Connecting a local terminal console cable to your router Navigating through the console screens Easy Setup console screens Chapter Easy SetupHow to access the Easy Setup console screens Screen similar to the following appears Easy Setup proﬁle Beginning Easy Setup IP Easy Setup Ethernet IP Address 192.168.1.1 Ethernet Subnet Mask Easy Setup Security Part II Advanced Configuration User’s Reference Guide Chapter WAN and System Configuration WAN Creating a new Connection Proﬁle Datalink PPP/MP Options Data Compression IPX Profile Parameters Remote IPX Network Viewing or editing connection proﬁles Change Connection Profile Profile Name System Conﬁguration screens Deleting connection proﬁles Navigating through the System Conﬁguration screens System Conﬁguration features Maximum Packet Size 1500 Channel Usage Dynamic Bandwidth Allocation Filter Sets Firewalls Network Protocols Setup Date and Time IP Address ServingConsole Conﬁguration Snmp Simple Network Management Protocol Upgrade Feature SetSecurity Logging Installing the Syslog client PPP MP Specifying telephone connections Chapter Managing Data CallsInternal Modem Conﬁguration screen appears Atdt Auxiliary serial port HD-15 female OFF How the Default Answer Proﬁle works Default Answer Proﬁle for Dial-in ConnectionsCustomizing the default proﬁle PAP Call acceptance scenarios Scheduled connections Adding a scheduled connection Viewing scheduled connections ADD Scheduled Connection Cancel Set Once-Only Schedule Set Weekly Schedule Modifying a scheduled connection Web-based management pages Connection MeteringDeleting a scheduled connection System Information Activity for your Frame relay DLCIs Accounting for switched interfaces only Connection Status Connect/Disconnect Router Budget Configuration Connection Budgets Connection Budget Configuration Budget Statistics WAN Event History Event History pages Device Event History Console-based management screens Connection Budget Setup Name Use Connection Profile Connection Budget Statistics Date and time setting Chapter Virtual Private Networks Tr ans it In tern etw ork Summary About Pptp tunnels on About Atmp Tunnels on Configuration Add Connection Profile Pptp ConfigurationAbout Pptp tunnels Chap Local WAN IP Address 0.0 Remote IP Address Encryption support VPN Default Answer Profile QuickView VPN QuickView Dial-Up Networking for VPN Installing Dial-Up Networking Creating a new Dial-Up Networking profile Configuring a Dial-Up Networking profile Virtual Private Networks Windows 95 VPN installation Installing the VPN ClientWindows 98 VPN installation Connecting using Dial-Up Networking About Atmp Tunnels Atmp Configuration DES Local WAN IP Address 0.0 Remote IP Address Pptp Example Allowing VPNs though a firewall Select Display/Change Input Filter Change Output Filter EnabledYes ForwardYes Source IP Address Atmp Example Source Port ID Dest. Port Compare Change Output Filter EnabledYes ForwardYes Source IP Address Chapter Multiple Network Address Translation and IP Setup User’s Reference Guide Supported traffic Features NAT conﬁguration Easy Setup Profile IP setup 255.255.255.0 NAT rules ADD NAT MAP Add NAT Map mymap Modifying map lists Show/Change NAT Map List screen appears Change NAT Map screen appears Moving maps Adding server lists ADD NAT Server Modifying server lists Show/Change NAT Server List screen appears Deleting a server IP profile parameters Binding Map Lists and Server Lists +--NAT Map List Name Configuration Default Answer Profile Default Answer Profile Default Answer Proﬁle screen appears Associations NAT Associations NAT Associations +NAT Map List Name-+ MultiNAT Configuration Example Previous Screen Enter your ISP-supplied values as shown below Change NAT Public Range ADD NAT MAP Firmware upgrades and NAT IP subnets For example Static routes Viewing static routes Adding a static route Modifying a static route Rules of static route installationDeleting a static route Main Menu System Configuration IP Address Serving Client Default Gateway Dhcp NetBIOS Options NetBios Type To release these addresses, select Lease Management Served IP Addresses screen appears Dhcp Relay Agent MacIP Kip Forwarding Options You have ﬁnished your IP Setup Internetwork Packet Exchange IPX Chapter IPX SetupIPX Features IPX Deﬁnitions Routing Information Protocol RIP Service Advertising Protocol SAPIPX address Socket IPX setup NetBIOSIPX Spooﬁng Default Gateway Address IPX in the answer proﬁle Menu Configuration Default Answer Profile Off Main Menu Statistics & Logs IPX routing tables User’s Reference Guide AppleTalk networks Chapter AppleTalk SetupAppleTalk protocol AT Routing Table Routers and seeding MacIP Installing AppleTalk Upgrade Feature Set Conﬁguring AppleTalk EtherTalk Setup LocalTalk Setup Viewing Aurp partners Aurp setupAurp Free Trade Zone Modifying an Aurp partner Adding an Aurp partner Receiving Aurp connections Deleting an Aurp partnerConﬁguring Aurp Options AppleTalk Setup User’s Reference Guide Quick View status overview Chapter Monitoring Tools General Status Status lights Current Status General Statistics Statistics & LogsGeneral Statistics WAN Connection Statistics Event Histories WAN Event History Current Date Routing Tables IPX routing table IP routing table AppleTalk routing table IPX Sap Bindery table Served IP Addresses IP Address Lease Management screen appears Snmp Community strings Snmp Setup screen Snmp traps Deleting IP trap receivers Setting the IP trap receiversViewing IP trap receivers Modifying IP trap receivers User’s Reference Guide Suggested security measures Chapter Security Protecting the Security Options screen User accountsProtecting the conﬁguration screens Dial-in Console Access What’s a ﬁlter and what’s a ﬁlter set? Enable SmartStart/Web ServerTelnet access About ﬁlters and ﬁlter sets Filter priority How ﬁlter sets work Packet First filter Match? Yes Parts of a ﬁlter How individual ﬁlters workﬁlter’s actions ﬁltering rule Port number comparisons Internet service TCP port161 Aurp AppleTalk 387 Who 513 User Datagram Protocol Putting the parts togetherInternet Control Message Protocol Transmission Control Protocol Filtering example #2 Filtering example #1 Disadvantages of ﬁlters Design guidelines Working with IP ﬁlters and ﬁlter sets An approach to using ﬁlters Naming a new ﬁlter set Adding a ﬁlter set Netopia R-series Router Input and output ﬁlters-source and destinationAdding ﬁlters to a ﬁlter set ADD this Filter NOW Cancel Deleting ﬁlters Viewing ﬁlter setsViewing ﬁlters Modifying ﬁlters Deleting a ﬁlter set Modifying ﬁlter setsSample IP ﬁlter set TCP Icmp UDP Possible modiﬁcations User’s Reference Guide IPX ﬁlters Main Menu System Configuration Filter Sets Firewalls Viewing and modifying packet ﬁlters IPX packet ﬁltersAdding a packet ﬁlter Adding a packet ﬁlter set IPX packet ﬁlter setsDeleting a packet ﬁlter Viewing and modifying packet ﬁlter sets ADD Filter SET NOW Cancel Deleting a packet ﬁlter set IPX SAP ﬁltersViewing and modifying SAP ﬁlters Adding a SAP ﬁlter Adding a SAP ﬁlter set IPX SAP ﬁlter setsDeleting a SAP ﬁlter Viewing and modifying SAP ﬁlter sets Deleting a SAP ﬁlter set Firewall tutorial General Firewall Terms Basic Protocol Types Basic IP Packet ComponentsExample TCP/UDP Ports Firewall Logic Firewall design rulesBinary Representation Implied Rules Logical ANDingEstablished Connections Example IP Filter Set Screen Filter BasicsThis is an example of the Netopia IP ﬁlter set screen Example Network Example FiltersExample Example Example Securing network environments Token Security AuthenticationUsing the SecurID token card Key Security Authentication Features of the Netopia R2020 Conﬁguring for security authentication Security authentication components Establishing a dial-on-demand DOD connection call Connecting using security authentication Current Connection Status Establishing a manual connection call Chapter Utilities and Diagnostics Start Ping Ping Utilities and Diagnostics Stop Ping Time Trace Route Telnet client Secure Authentication Monitor Disconnect Telnet Console Session Factory defaultsTransferring conﬁguration and ﬁrmware ﬁles with Tftp Updating ﬁrmware Downloading conﬁguration ﬁles Transferring conﬁguration and ﬁrmware ﬁles with Xmodem Uploading conﬁguration ﬁles Idle Do you want to send a saved configuration to your Netopia? Restarting the system User’s Reference Guide Part III Appendixes User’s Reference Guide Conﬁguration problems Appendix a Troubleshooting Console connection problems SmartStart TroubleshootingNetwork problems Before contacting Netopia Power outagesHow to reach us Technical support FAX-Back Netopia Bulletin Board Service 1Online product information Product information can be found in the following Finding an Internet service provider Appendix B Setting Up Internet Services ISP’s Point of presence Setting up a Netopia R2020 accountUnique requirements Pricing and support Obtaining information from the ISP Local LAN IP address information to obtain NAT enabledLocal LAN IP address information to obtain NAT-disabled SmartIP Remote WAN IP address information to obtain Appendix C Understanding IP Addressing What is IP?About IP addressing Subnets and subnet masks Subnet masks Example Using subnets on a Class C IP internet ISP Network Network conﬁguration Distributing IP addresses Example Working with a Class C subnetBackground 255.255.255.224 Technical note on subnet masking Conﬁguration Netopia R2020 Dhcp Server CharacteristicsDhcp Address Serving Serve dynamic WAN clients Using address servingManually distributing IP addresses MacIP Serving Understanding IP Addressing C-9 Tips and rules for distributing IP addresses Dhcp example Internet Nested IP subnets 0.0 C.1 WAN Packet header types Broadcasts User’s Reference Guide Appendix D Binary Conversion Table Decimal Binary Appendix E Further Reading User’s Reference Guide Further Reading E-3 User’s Reference Guide Pinouts for Auxiliary Port Modem Cable Appendix F Technical Specifications and Safety Information VDC input Amps Power requirementsDescription Environment Agency approvals Software and protocolsRegulatory notices Declaration for Canadian users Telecommunication installation cautions Important safety instructionsBattery User’s Reference Guide Outbound data 33.6K 67.2K Inbound data 56K 112K Appendix G About 56K Line Access User’s Reference Guide Bps See bits per second Glossary User’s Reference Guide Glossary User’s Reference Guide Remapping See network number remapping User’s Reference Guide Glossary User’s Reference Guide Numerics Index Index-2 Index-3 Index-4 Index-5 Index-6 Limited Warranty and Limitation of Remedies User’s Reference Guide