Filter Basics, Established Connections | Netopia R3100 instruction

Security 15-33

Established Connections

The TCP header contains one bit called the ACK Bit (or TCP Ack bit). This ACK Bit only appears with TCP, not UDP. The ACK bit is part of the TCP mechanism that guaranteed the delivery of data. The ACK bit is set whenever one side of a connection has received data from the other side. Only the ﬁrst TCP packet will not have the ACK bit set, once the TCP connection is in place the remainder of the TCP packets with have the ACK bit set.

The ACK bit is helpful for ﬁrewall design and reduces the number of potential ﬁlter rules. A ﬁlter rule could be created just allowing incoming TCP packets with the ACK bit set, as these packets had to be originated from the local network.

Example IP Filter Set Screen

This is an example of the Netopia IP ﬁlter set screen:

Change Filter
Enabled:	Yes
Forward:	No
Source IP Address:	0.0.0.0
Source IP Address Mask:	0.0.0.0
Dest. IP Address:	0.0.0.0
Dest. IP Address Mask:	0.0.0.0
Protocol Type:	TCP
Source Port Compare...	No Compare
Source Port ID:	0
Dest. Port Compare...	Equal
Dest. Port ID:	2000
Established TCP Conns. Only:	No

Return/Enter accepts * Tab toggles * ESC cancels.

Enter the IP specific information for this filter.

Filter Basics

In the source or destination IP address ﬁelds, the IP address that is entered MUST be the NETWORK address of the subnet. A HOST address can be entered, but the applied subnet mask must be 32 bits (255.255.255.255).

The Netopia R3100 has the ability to compare source and destination TCP or UDP ports. These options are as follows:

Item	What it means

No compare	Does not compare TCP or UDP port

Not Equal To	Matches any port other than what is deﬁned

Less Than	Anything less than the port deﬁned

Image 211

Netopia R3100 manual Filter Basics, Established Connections, Example IP Filter Set Screen

Contents

Netopia R3100 Isdn Routers Part Number Contents Ii User’s Reference Guide Part II Advanced Configuration Iv User’s Reference Guide Aurp Vi User’s Reference Guide Part III Appendixes Viii User’s Reference Guide Contents User’s Reference Guide Conﬁguration options for your Netopia R3100 Isdn Router Small Ofﬁce connection to the Internet Small Ofﬁce connection to the Internet Direct Connection to a Corporate Ofﬁce Telecommuter Conﬁgured to accept incoming dial-up connections Conﬁgured for Idsl Part I Getting Started User’s Reference Guide Introduction Features and capabilitiesChapter Introduction Overview How to use this guide Making the Physical Connections Chapter Making the Physical ConnectionsFind a location What you need Identify the connectors and attach the cables Netopia R3100 Isdn Router Back Panel Ports Cable to your router on Services on Netopia R3100 LED front panel Netopia R3100 Isdn Router Status Lights Setting up your Router with the SmartStart Wizard Chapter Setting up your Router with the SmartStart Wizard Before running SmartStart SmartStart Wizard conﬁguration screens Setting up your Router with the SmartStart Wizard Easy option Easy or Advanced setup Setting up your Router with the SmartStart Wizard User’s Reference Guide Setting up your Router with the SmartStart Wizard User’s Reference Guide Advanced option Connection Proﬁle screen on Conﬁguration tab Dynamic conﬁguration recommended Static conﬁguration optional Add. Repeat this process for the secondary DNS TCP/IP Conﬁguring TCP/IP on Macintosh computers TCP/IP or MacTCP Dynamic conﬁguration using MacIP optional Setting up your Router with the SmartStart Wizard User’s Reference Guide Connecting Your Local Area Network Chapter Connecting Your Local Area Network Readying computers on your local network 10Base-T Connecting to an Ethernet network 10BASE-T Remote console Connecting to a LocalTalk network Wiring guidelines for PhoneNET cabling User’s Reference Guide SmartView overview Chapter SmartViewSmartView General Machine information Navigating SmartView Event history pages Connection Proﬁles Device Event History WAN Event History Standard Html web-based monitoring pages User’s Reference Guide About Console-based Management Chapter Console-based ManagementConsole-based Management Connecting through a Telnet session Conﬁguring Telnet software Connecting a local terminal console cable to your router PC ANSI-BBS Navigating through the console screens User’s Reference Guide Easy Setup Chapter Easy SetupEasy Setup console screens How to access the Easy Setup console screens See Appendix A, Troubleshooting, for more suggestions Isdn Easy Setup Beginning Easy Setup PPP Cancel Idsl Easy Setup Previous Screen Easy Setup Proﬁle User’s Reference Guide Previous Screen Next Screen IP Easy Setup Easy Setup Security Conﬁguring Frame Relay Isdn Easy Setup Frame Relay screens WAN Conﬁguration Frame Relay screens Setup Isdn Line Configuration Frame Relay conﬁguration Easy Setup Frame Relay Dlci conﬁguration Displaying a Frame Relay Dlci conﬁguration table Changing a Frame Relay Dlci conﬁguration Adding a Frame Relay Dlci conﬁguration ADD Dlci NOW Cancel Deleting a Frame Relay Dlci conﬁguration Part II Advanced Configuration User’s Reference Guide Creating a new Connection Proﬁle Chapter WAN and System ConfigurationWAN and System Conﬁguration Add Connection Proﬁle screen appears IPX Profile Parameters Remote IPX Network BAP Telco Options Initiate Data Service 64 kb/sec Dial Default Proﬁle How the default proﬁle works Configuration Default Profile Customizing the Default Proﬁle IP parameters default proﬁle screen WAN and System Conﬁguration Auxiliary Port Conﬁguration IPX parameters default proﬁle screen System Conﬁguration screens System Conﬁguration features PAP Date and Time Network Protocols SetupFilter Sets Firewalls IP Address Serving MM/DD/YY Security Upgrade Feature SetConsole Conﬁguration Snmp Simple Network Management Protocol Logging Telephone setup Nov Using SmartPhone for Telephone Services Chapter Using SmartPhone for Telephone ServicesSpecifying telephone connections Inbound Directory Number Using SmartPhone for Telephone Services Preview Ring Deﬁning priority ringing Line provisioning Advanced calling features Conﬁguring supplementary services Cost control feature -- call accounting Chapter Call Accounting and Default Answer ProfileCall Accounting and Default Answer Proﬁle Viewing call accounting statistics Call Accounting Statistics screen appears Scheduled connections Viewing scheduled connections Adding a scheduled connection Set Weekly Schedule Set Once-Only Schedule Deleting a scheduled connection Default Answer ProﬁleHow the Default Answer Proﬁle works Modifying a scheduled connection Customizing the default proﬁle Call Accounting and Default Answer Proﬁle Call acceptance scenarios Network Address Translation features Chapter IP Setup and Network Address TranslationIP Setup and Network Address Translation HOW NAT Works Using Network Address Translation ISP Associating port numbers to nodes Using multiple Connection ProﬁlesNetwork Address Translation guidelines IP setup IP Setup and Network Address Translation Select Add Export. The Add Exported Service screen appears IP Setup IP subnets IP Setup and Network Address Translation Static routes Viewing static routes Adding a static route Modifying a static route Rules of static route installationDeleting a static route Main System IP Address Menu Configuration Serving 163.176.56.90 Dhcp NetBIOS Options MacIP Kip Forwarding Options You have ﬁnished your IP Setup IPX Deﬁnitions Chapter IPX SetupIPX Features IPX Setup Routing Information Protocol RIP Service Advertising Protocol SAPIPX address Socket IPX setup NetBIOSIPX Spooﬁng Default Gateway Address IPX routing tables User’s Reference Guide Installing AppleTalk Chapter AppleTalk SetupAppleTalk Setup AppleTalk protocol AppleTalk networks AppleTalk Setup Aurp MacIP Routers and seeding Conﬁguring AppleTalk EtherTalk Setup LocalTalk Setup Viewing Aurp partners Aurp setupAurp Free Trade Zone Modifying an Aurp partner Adding an Aurp partner Receiving Aurp connections Deleting an Aurp partnerConﬁguring Aurp Options User’s Reference Guide Quick View status overview Chapter Monitoring ToolsMonitoring Tools General status Status lights Current status General Statistics Statistics & Logs Physical Interface Event historiesNetwork Interface Request from our DN WAN Event History Device Event History Routing tables IP routing table IPX Sap Bindery table IPX routing tableAppleTalk routing table Served IP Addresses IP Address Lease Management screen appears Snmp System Information Community strings Snmp Setup screen Snmp traps Deleting IP trap receivers Setting the IP trap receiversViewing IP trap receivers Modifying IP trap receivers User’s Reference Guide Suggested security measures Chapter SecuritySecurity Protecting the Security Options screen User accountsProtecting the conﬁguration screens Dial-in Console Access What’s a ﬁlter and what’s a ﬁlter set? Enable SmartStart/SmartView/Web ServerTelnet access About ﬁlters and ﬁlter sets Filter priority How ﬁlter sets work Packet First filter Match? Yes Parts of a ﬁlter How individual ﬁlters workﬁlter’s actions ﬁltering rule Port number comparisons Port numbers Putting the parts together Other ﬁlter attributes Filtering example #1 UDP Filtering example #2 Design guidelines Working with IP ﬁlters and ﬁlter sets An approach to using ﬁltersDisadvantages of ﬁlters Adding a ﬁlter set Input and output ﬁlters-source and destination Naming a new ﬁlter set Adding ﬁlters to a ﬁlter set Netopia R-series Router ADD this Filter NOW Cancel Deleting ﬁlters Viewing ﬁlter setsViewing ﬁlters Modifying ﬁlters Deleting a ﬁlter set Modifying ﬁlter setsSample IP ﬁlter set TCP Icmp UDP Possible modiﬁcations Security IPX ﬁlters Viewing and modifying packet ﬁlters IPX packet ﬁltersAdding a packet ﬁlter Adding a packet ﬁlter set IPX packet ﬁlter setsDeleting a packet ﬁlter Viewing and modifying packet ﬁlter sets ADD Filter SET NOW Cancel Deleting a packet ﬁlter set IPX SAP ﬁltersViewing and modifying SAP ﬁlters Adding a SAP ﬁlter Adding a SAP ﬁlter set IPX SAP ﬁlter setsDeleting a SAP ﬁlter Viewing and modifying SAP ﬁlter sets Deleting a SAP ﬁlter set Basic IP Packet Components Firewall tutorial General Firewall TermsBasic Protocol Types Example TCP/UDP Ports Firewall design rulesFirewall Logic Logical ANDing Binary RepresentationImplied Rules Established Connections Filter BasicsExample IP Filter Set Screen Example Network Example FiltersExample Example Example Securing network environments Token Security AuthenticationUsing the SecurID token card Key Security Authentication Features of the Netopia R3100 Conﬁguring for security authentication Security authentication components Establishing a dial-on-demand DOD connection call Connecting using security authentication Current Connection Status Establishing a manual connection call User’s Reference Guide Utilities and Diagnostics Chapter Utilities and Diagnostics Start Ping Ping Utilities and Diagnostics Stop Ping Telnet client Telnet client screen appears Trace Route Secure Authentication Monitor Disconnect Telnet Console Session Factory defaultsTransferring conﬁguration and ﬁrmware ﬁles with Tftp Updating ﬁrmware Uploading conﬁguration ﬁles Downloading conﬁguration ﬁles Transferring conﬁguration and ﬁrmware ﬁles with Xmodem Do you want to send a saved configuration to your Netopia? Restarting the system Isdn Switch Loopback Test User’s Reference Guide If the loopback test fails Part III Appendixes User’s Reference Guide Conﬁguration problems Appendix a TroubleshootingTroubleshooting A-1 Console connection problems SmartStart TroubleshootingNetwork problems Before contacting Netopia Power outagesHow to get support Technical support FAX-Back Online product information Choosing an Isdn line Appendix B Setting Up Telco ServicesFinding an Isdn service provider Obtaining an Isdn line Physical Isdn line Setup tipsIsdn Ordering Codes Circuit ID number U models only Switch protocol typeOutside North America only Directory and Spid numbers U models only Long-distance Isdn calls North American models only Testing the Isdn line Completing the Isdn worksheet Isdn Telco Worksheet for North America Isdn Telco Worksheet for Outside North America User’s Reference Guide North American Telco Provisioning for Isdn Appendix C North American Telco Provisioning for Isdn User’s Reference Guide Unique requirements Appendix D Setting Up Internet ServicesFinding an Internet service provider Setting Up Internet Services D-1 Endorsements Deciding on an ISP account Setting up a Netopia R3100 accountPricing and support ISP’s Point of presence Remote WAN IP address information to obtain Obtaining information from the ISPLocal LAN IP address information to obtain With Network Address Translation Remote WAN IP address information to obtain Understanding IP Addressing E-1 What is IP?Appendix E Understanding IP Addressing About IP addressing Subnets and subnet masks Understanding IP Addressing E-3 Example Using subnets on a Class C IP internetSubnet masks ISP Network Network conﬁguration Background Example Working with a Class C subnetDistributing IP addresses Understanding IP Addressing E-5 Technical note on subnet masking Dhcp Address Serving Netopia R3100 Dhcp Server CharacteristicsConﬁguration Understanding IP Addressing E-7 MacIP Serving Using address servingManually distributing IP addresses Tips and rules for distributing IP addresses Dhcp example Understanding IP Addressing E-9 Internet Nested IP subnets Understanding IP Addressing E-11 Packet header types Broadcasts Understanding Netopia NAT Behavior F-1 Appendix F Understanding Netopia NAT BehaviorNetwork Conﬁguration Background User’s Reference Guide Understanding Netopia NAT Behavior F-3 Router Netopia Router Netopia Understanding Netopia NAT Behavior F-5 Exported services Important notes Understanding Netopia NAT Behavior F-7 Summary Virtual Circuits Appendix G Understanding Frame RelayUnderstanding Frame Relay G-1 Committed Burst Size Bc Committed Information Rate CIRExcess Burst Size Be Understanding Frame Relay G-3 AddressingLocal and Global DLCIs Local Management Interface LMI Network Protocol Addressing and Virtual Interfaces Encapsulation and FragmentationFrame Relay partial mesh support Understanding Frame Relay G-5 User’s Reference Guide Event Histories Appendix H Event HistoriesLeased line events Isdn events Isdn event cause codes Event Histories User’s Reference Guide Event Histories User’s Reference Guide Isdn Conﬁguration Guide Appendix Isdn Conﬁguration GuideDeﬁnitions About SPIDs Dynamic B-channel usage Example SPIDs Other incoming call restrictions User’s Reference Guide Binary Conversion Table J-1 Appendix J Binary Conversion Table Decimal Binary Further Reading K-1 Appendix K Further Reading User’s Reference Guide Further Reading K-3 User’s Reference Guide Technical Speciﬁcations and Safety Information L-1 Appendix L Technical Specifications and Safety InformationPinouts for Auxiliary Port Modem Cable DSR Environment Power requirementsTechnical Speciﬁcations and Safety Information L-3 Description International Agency approvalsRegulatory notices North America Technical Speciﬁcations and Safety Information L-5 Australian Safety Information Important safety instructionsDeclaration for Canadian users Telecommunication installation cautions Technical Speciﬁcations and Safety Information L-7Battery User’s Reference Guide Glossary Glossary User’s Reference Guide Glossary User’s Reference Guide Glossary Remapping See network number remapping Glossary User’s Reference Guide Index-1 Index Index-2 ISP Index-3 NAT Index-4 Spid Index-5 Index-6 Limited Warranty and Limitation of Remedies Limited Warranty and Limitation of Remedies User’s Reference Guide