Chapter 11 Packet Filter

 

Table 65 Security > Packet Filter > Edit (Generic Filter) > Edit Rule (continued)

 

LABEL

DESCRIPTION

 

Value

Enter the value (in hexadecimal notation) to compare with the data portion.

 

 

 

 

More

Select Yes to pass a matching packet to the next filter rule before an action

 

 

is taken.

 

 

Select No to act upon the packet according to the action fields.

 

 

 

 

Log

Select a logging option from the following:

 

 

None – No packets will be logged.

 

 

Match - Only packets that match the rule parameters will be logged.

 

 

Not Match - Only packets that do not match the rule parameters will be

 

 

logged.

 

 

Both – All packets will be logged.

 

 

 

 

Action Match

Select the action for a matching packet.

 

 

Options are Check Next Rule, Forward and Drop.

 

 

 

 

Action Not Match

Select the action for a packet not matching the rule.

 

 

Options are Check Next Rule, Forward and Drop.

 

 

 

 

Back

Click this to return to the previous screen without saving.

 

 

 

 

Apply

Click this to save your changes.

 

 

 

 

Cancel

Click this to restore your previously saved settings.

 

 

 

11.3 Packet Filter Technical Reference

This section provides some technical background information about the topics covered in this chapter.

11.3.1 Filter Types and NAT

There are two classes of filter rules, generic filter rules and protocol filter rules. Generic filter rules act on the raw data from/to LAN and WAN. Protocol filter rules act on the IP packets. When NAT (Network Address Translation) is enabled, the inside IP address and port number are replaced on a connection-by-connection basis, which makes it impossible to know the exact address and port on the wire. Therefore, the ZyXEL Device applies the protocol filters to the “native” IP address and port number before NAT for outgoing packets and after NAT for incoming packets. On the other hand, the generic filters are applied to the raw packets that appear on the wire. They are applied at the point when the ZyXEL Device is receiving and sending the packets; that is the interface. The interface can be an Ethernet port or any other hardware port. The following diagram illustrates this.

Figure 106 Protocol and Generic Filter Sets

Route

Protocol

 

 

 

NAT

 

 

 

Generic

 

 

 

 

 

 

 

 

Filters

 

 

 

 

 

Filters

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Incoming

Interface

Outgoing

 

183

P-660HN-F1 User’s Guide