Manuals / Netopia / Computer Equipment / Network Router

Netopia R3100 manual Firewall tutorial General Firewall Terms, Basic IP Packet Components

Models: R3100

1 320

Download 320 pages 53.76 Kb

Page 208

15-30 User’s Reference Guide

Firewall tutorial

General Firewall Terms

Firewall: a component or set of components that restrict access between a protected network and the Internet, or between two networks.

Host: A workstation on the Network.

Packet: Unit of communication on the Internet.

Packet Filter: Packet ﬁlters allow or deny packets based on source or destination IP addresses, TCP or UDP ports, or the TCP ACK bit.

Port: A number that deﬁnes a particular type of service.

Filter Rule: A ﬁlter set is comprised of individual ﬁlter rules.

Filter Set: A grouping of individual ﬁlter rules.

Basic IP Packet Components

All IP packets contain the same basic “header” information, as follows:

Source IP Address	163.176.132.18

Destination IP Address	163.176.4.27

Source Port	2541

Destination Port	80

Protocol	TCP

ACK Bit	Yes

DATA	User Data

This header information is what the packet ﬁlter uses to make ﬁltering decisions. It is important to note that a packet ﬁlter does not look into the IP datastream (the User Data from above) to make ﬁltering decisions.

Basic Protocol Types

TCP: Transmission Control Protocol. TCP provides reliable packet delivery and has a retransmission mechanism (so packets are not lost). RFC 793 is the speciﬁcation for TCP.

UDP: User Datagram Protocol. Unlike TCP, UDP does not guarantee reliable, sequenced packet delivery. If data does not reach its destination, UDP does not re transmit the data. RFC 768 is the speciﬁcation for UDP.

And there are many more ports deﬁned in the Assigned Addresses RFC.

Image 208

Netopia R3100 manual Firewall tutorial General Firewall Terms, Basic IP Packet Components, Basic Protocol Types

Contents

Netopia R3100 Isdn Routers Part Number Contents Ii User’s Reference Guide Part II Advanced Configuration Iv User’s Reference Guide Aurp Vi User’s Reference Guide Part III Appendixes Viii User’s Reference Guide Contents User’s Reference Guide Conﬁguration options for your Netopia R3100 Isdn Router Small Ofﬁce connection to the Internet Small Ofﬁce connection to the Internet Direct Connection to a Corporate Ofﬁce Telecommuter Conﬁgured to accept incoming dial-up connections Conﬁgured for Idsl Part I Getting Started User’s Reference Guide Features and capabilities Chapter IntroductionOverview IntroductionHow to use this guide Chapter Making the Physical Connections Find a locationWhat you need Making the Physical ConnectionsIdentify the connectors and attach the cables Netopia R3100 Isdn Router Back Panel Ports Cable to your router on Services on Netopia R3100 Isdn Router Status Lights Netopia R3100 LED front panelChapter Setting up your Router with the SmartStart Wizard Setting up your Router with the SmartStart WizardBefore running SmartStart Setting up your Router with the SmartStart Wizard SmartStart Wizard conﬁguration screensEasy or Advanced setup Easy optionSetting up your Router with the SmartStart Wizard User’s Reference Guide Setting up your Router with the SmartStart Wizard User’s Reference Guide Advanced option Connection Proﬁle screen on Dynamic conﬁguration recommended Conﬁguration tabStatic conﬁguration optional Add. Repeat this process for the secondary DNS Conﬁguring TCP/IP on Macintosh computers TCP/IPTCP/IP or MacTCP Dynamic conﬁguration using MacIP optional Setting up your Router with the SmartStart Wizard User’s Reference Guide Chapter Connecting Your Local Area Network Connecting Your Local Area NetworkReadying computers on your local network Connecting to an Ethernet network 10Base-T10BASE-T Remote console Connecting to a LocalTalk network Wiring guidelines for PhoneNET cabling User’s Reference Guide SmartView overview Chapter SmartViewSmartView Navigating SmartView General Machine informationConnection Proﬁles Event history pagesDevice Event History WAN Event History Standard Html web-based monitoring pages User’s Reference Guide About Console-based Management Chapter Console-based ManagementConsole-based Management Connecting through a Telnet session Connecting a local terminal console cable to your router Conﬁguring Telnet softwarePC ANSI-BBS Navigating through the console screens User’s Reference Guide Chapter Easy Setup Easy Setup console screensHow to access the Easy Setup console screens Easy SetupSee Appendix A, Troubleshooting, for more suggestions Beginning Easy Setup Isdn Easy SetupPPP Cancel Idsl Easy Setup Easy Setup Proﬁle Previous ScreenUser’s Reference Guide IP Easy Setup Previous Screen Next ScreenEasy Setup Security Conﬁguring Frame Relay Easy Setup Frame Relay screens IsdnSetup Isdn Line Configuration WAN Conﬁguration Frame Relay screensFrame Relay conﬁguration Easy Setup Frame Relay Dlci conﬁguration Displaying a Frame Relay Dlci conﬁguration table Changing a Frame Relay Dlci conﬁguration ADD Dlci NOW Cancel Adding a Frame Relay Dlci conﬁgurationDeleting a Frame Relay Dlci conﬁguration Part II Advanced Configuration User’s Reference Guide Creating a new Connection Proﬁle Chapter WAN and System ConfigurationWAN and System Conﬁguration Add Connection Proﬁle screen appears IPX Profile Parameters Remote IPX Network BAP Telco Options Initiate Data Service 64 kb/sec Dial Default Proﬁle How the default proﬁle works Customizing the Default Proﬁle Configuration Default ProfileIP parameters default proﬁle screen WAN and System Conﬁguration IPX parameters default proﬁle screen Auxiliary Port ConﬁgurationSystem Conﬁguration screens System Conﬁguration features PAP Network Protocols Setup Filter Sets FirewallsIP Address Serving Date and TimeMM/DD/YY Upgrade Feature Set Console ConﬁgurationSnmp Simple Network Management Protocol SecurityTelephone setup LoggingNov Using SmartPhone for Telephone Services Chapter Using SmartPhone for Telephone ServicesSpecifying telephone connections Inbound Directory Number Using SmartPhone for Telephone Services Deﬁning priority ringing Preview RingAdvanced calling features Line provisioningConﬁguring supplementary services Cost control feature -- call accounting Chapter Call Accounting and Default Answer ProfileCall Accounting and Default Answer Proﬁle Viewing call accounting statistics Call Accounting Statistics screen appears Scheduled connections Viewing scheduled connections Adding a scheduled connection Set Weekly Schedule Set Once-Only Schedule Default Answer Proﬁle How the Default Answer Proﬁle worksModifying a scheduled connection Deleting a scheduled connectionCustomizing the default proﬁle Call Accounting and Default Answer Proﬁle Call acceptance scenarios Network Address Translation features Chapter IP Setup and Network Address TranslationIP Setup and Network Address Translation HOW NAT Works Using Network Address Translation ISP Associating port numbers to nodes Using multiple Connection ProﬁlesNetwork Address Translation guidelines IP setup IP Setup and Network Address Translation Select Add Export. The Add Exported Service screen appears IP Setup IP subnets IP Setup and Network Address Translation Static routes Viewing static routes Adding a static route Modifying a static route Rules of static route installationDeleting a static route Main System IP Address Menu Configuration Serving 163.176.56.90 Dhcp NetBIOS Options MacIP Kip Forwarding Options You have ﬁnished your IP Setup Chapter IPX Setup IPX FeaturesIPX Setup IPX DeﬁnitionsService Advertising Protocol SAP IPX addressSocket Routing Information Protocol RIPIPX setup NetBIOSIPX Spooﬁng Default Gateway Address IPX routing tables User’s Reference Guide Installing AppleTalk Chapter AppleTalk SetupAppleTalk Setup AppleTalk networks AppleTalk protocolAppleTalk Setup MacIP AurpRouters and seeding Conﬁguring AppleTalk EtherTalk Setup LocalTalk Setup Viewing Aurp partners Aurp setupAurp Free Trade Zone Adding an Aurp partner Modifying an Aurp partnerReceiving Aurp connections Deleting an Aurp partnerConﬁguring Aurp Options User’s Reference Guide Quick View status overview Chapter Monitoring ToolsMonitoring Tools General status Current status Status lightsStatistics & Logs General StatisticsPhysical Interface Event historiesNetwork Interface WAN Event History Request from our DNRouting tables Device Event HistoryIP routing table IPX Sap Bindery table IPX routing tableAppleTalk routing table Served IP Addresses IP Address Lease Management screen appears System Information SnmpSnmp Setup screen Community stringsSnmp traps Setting the IP trap receivers Viewing IP trap receiversModifying IP trap receivers Deleting IP trap receiversUser’s Reference Guide Suggested security measures Chapter SecuritySecurity Protecting the Security Options screen User accountsProtecting the conﬁguration screens Dial-in Console Access Enable SmartStart/SmartView/Web Server Telnet accessAbout ﬁlters and ﬁlter sets What’s a ﬁlter and what’s a ﬁlter set?How ﬁlter sets work Filter priorityPacket First filter Match? Yes How individual ﬁlters work ﬁlter’s actionsﬁltering rule Parts of a ﬁlterPort numbers Port number comparisonsOther ﬁlter attributes Putting the parts togetherUDP Filtering example #1Design guidelines Filtering example #2Working with IP ﬁlters and ﬁlter sets An approach to using ﬁltersDisadvantages of ﬁlters Adding a ﬁlter set Naming a new ﬁlter set Input and output ﬁlters-source and destinationNetopia R-series Router Adding ﬁlters to a ﬁlter setADD this Filter NOW Cancel Viewing ﬁlter sets Viewing ﬁltersModifying ﬁlters Deleting ﬁltersDeleting a ﬁlter set Modifying ﬁlter setsSample IP ﬁlter set TCP Icmp UDP Possible modiﬁcations Security IPX ﬁlters Viewing and modifying packet ﬁlters IPX packet ﬁltersAdding a packet ﬁlter IPX packet ﬁlter sets Deleting a packet ﬁlterViewing and modifying packet ﬁlter sets Adding a packet ﬁlter setADD Filter SET NOW Cancel Deleting a packet ﬁlter set IPX SAP ﬁltersViewing and modifying SAP ﬁlters Adding a SAP ﬁlter IPX SAP ﬁlter sets Deleting a SAP ﬁlterViewing and modifying SAP ﬁlter sets Adding a SAP ﬁlter setDeleting a SAP ﬁlter set Basic IP Packet Components Firewall tutorial General Firewall TermsBasic Protocol Types Example TCP/UDP Ports Firewall design rulesFirewall Logic Logical ANDing Binary RepresentationImplied Rules Established Connections Filter BasicsExample IP Filter Set Screen Example Network Example FiltersExample Example Example Token Security Authentication Using the SecurID token cardKey Security Authentication Features of the Netopia R3100 Securing network environmentsSecurity authentication components Conﬁguring for security authenticationConnecting using security authentication Establishing a dial-on-demand DOD connection callCurrent Connection Status Establishing a manual connection call User’s Reference Guide Chapter Utilities and Diagnostics Utilities and DiagnosticsPing Start PingUtilities and Diagnostics Telnet client Stop PingTrace Route Telnet client screen appearsSecure Authentication Monitor Disconnect Telnet Console Session Factory defaultsTransferring conﬁguration and ﬁrmware ﬁles with Tftp Updating ﬁrmware Downloading conﬁguration ﬁles Uploading conﬁguration ﬁlesTransferring conﬁguration and ﬁrmware ﬁles with Xmodem Do you want to send a saved configuration to your Netopia? Restarting the system Isdn Switch Loopback Test User’s Reference Guide If the loopback test fails Part III Appendixes User’s Reference Guide Conﬁguration problems Appendix a TroubleshootingTroubleshooting A-1 Console connection problems SmartStart TroubleshootingNetwork problems Power outages How to get supportTechnical support Before contacting NetopiaOnline product information FAX-BackAppendix B Setting Up Telco Services Finding an Isdn service providerObtaining an Isdn line Choosing an Isdn linePhysical Isdn line Setup tipsIsdn Ordering Codes Switch protocol type Outside North America onlyDirectory and Spid numbers U models only Circuit ID number U models onlyTesting the Isdn line Long-distance Isdn calls North American models onlyCompleting the Isdn worksheet Isdn Telco Worksheet for North America Isdn Telco Worksheet for Outside North America User’s Reference Guide Appendix C North American Telco Provisioning for Isdn North American Telco Provisioning for IsdnUser’s Reference Guide Appendix D Setting Up Internet Services Finding an Internet service providerSetting Up Internet Services D-1 Unique requirementsSetting up a Netopia R3100 account Pricing and supportISP’s Point of presence Endorsements Deciding on an ISP accountObtaining information from the ISP Local LAN IP address information to obtainWith Network Address Translation Remote WAN IP address information to obtainRemote WAN IP address information to obtain What is IP? Appendix E Understanding IP AddressingAbout IP addressing Understanding IP Addressing E-1Subnets and subnet masks Understanding IP Addressing E-3 Example Using subnets on a Class C IP internetSubnet masks Network conﬁguration ISP NetworkExample Working with a Class C subnet Distributing IP addressesUnderstanding IP Addressing E-5 BackgroundTechnical note on subnet masking Netopia R3100 Dhcp Server Characteristics ConﬁgurationUnderstanding IP Addressing E-7 Dhcp Address ServingUsing address serving Manually distributing IP addressesTips and rules for distributing IP addresses MacIP ServingUnderstanding IP Addressing E-9 Dhcp exampleNested IP subnets InternetUnderstanding IP Addressing E-11 Broadcasts Packet header typesAppendix F Understanding Netopia NAT Behavior Network ConﬁgurationBackground Understanding Netopia NAT Behavior F-1User’s Reference Guide Router Netopia Understanding Netopia NAT Behavior F-3Router Netopia Exported services Understanding Netopia NAT Behavior F-5Important notes Understanding Netopia NAT Behavior F-7 Summary Virtual Circuits Appendix G Understanding Frame RelayUnderstanding Frame Relay G-1 Committed Burst Size Bc Committed Information Rate CIRExcess Burst Size Be Addressing Local and Global DLCIsLocal Management Interface LMI Understanding Frame Relay G-3Network Protocol Addressing and Virtual Interfaces Encapsulation and FragmentationFrame Relay partial mesh support Understanding Frame Relay G-5 User’s Reference Guide Appendix H Event Histories Leased line eventsIsdn events Event HistoriesIsdn event cause codes Event Histories User’s Reference Guide Event Histories User’s Reference Guide Appendix Isdn Conﬁguration Guide DeﬁnitionsAbout SPIDs Isdn Conﬁguration GuideExample SPIDs Dynamic B-channel usageOther incoming call restrictions User’s Reference Guide Appendix J Binary Conversion Table Binary Conversion Table J-1Decimal Binary Appendix K Further Reading Further Reading K-1User’s Reference Guide Further Reading K-3 User’s Reference Guide Technical Speciﬁcations and Safety Information L-1 Appendix L Technical Specifications and Safety InformationPinouts for Auxiliary Port Modem Cable DSR Power requirements Technical Speciﬁcations and Safety Information L-3Description EnvironmentAgency approvals Regulatory noticesNorth America InternationalTechnical Speciﬁcations and Safety Information L-5 Australian Safety Information Important safety instructionsDeclaration for Canadian users Telecommunication installation cautions Technical Speciﬁcations and Safety Information L-7Battery User’s Reference Guide Glossary GlossaryUser’s Reference Guide Glossary User’s Reference Guide Glossary Remapping See network number remapping Glossary User’s Reference Guide Index Index-1Index-2 Index-3 ISPIndex-4 NATIndex-5 SpidIndex-6 Limited Warranty and Limitation of Remedies Limited Warranty and Limitation of RemediesUser’s Reference Guide