User manual INTELLINET 516204

[. . . ] 2001 Limitation of Liability Information in this document is subject to change without notice and does not represent a commitment on the part. The material contained herein is supplied without representation or warranty of any kind. Therefore assumes no responsibility and shall have no liability of any kind arising from the supply or use of this document or the material contained herein. This manual copyright© 2001. No part of this document may be copied or re-used without prior written consent 1Broadband Router About This User Guide Welcome to the Networking world of multifunction routers! [. . . ] IF you want to add other services, you can click Add other PAT, to key in the service port Number, the private IP and re-mapped port number. Please check the samll box ahead of the PAT which you want to be active. Note: The Maximum of Add other PAT is 23. Firewall (IP/IPX Filtering) This section describes the packet filtering feature. Note: Packet filtering is a sophisticated feature that can substantially impact your Broadband Router operation. Therefore be sure that you fully understand the description in this chapter before you start to configure and use this feature, since if you make any mistakes, it may produce drastic and potentially undesired results. A Packet Filtering Overview The Broadband Router already provides you with many different ways to ensure the security of your data in your local environment. Packet filtering is a security feature that allows you to selectively pass or throw away data traffic between your local LAN and the wide area network (e. g. , the Internet). Packet Filtering allows each IP or IPX 4-12 packet exiting a router interface to be examined for a match with a configured set of rules and an action to be taken depending upon whether the packet statisfies any rule or not. In the browser manager, a set of rules may be configured over any existing interface as represented by a WAN profile. To configure a set of rules for packets exiting the LAN interface (in addition to any WAN interface), you must use the Filtering commands in the Command Line Interface. If the contents of the packet do not match any rule for that interface, then the packet is either forwarded or discarded, depending upon the filter default for that interface. Otherwise, the exception action is taken, i. e. , the packet is discarded or forwarded, the opposite of the default action. The Broadband Router maintains separate filtering tables for IP and IPX traffic. Configuration commands allow you to define: each and every IP or IPX packet to be inspected to determine if it should be allowed or disallowed to be transmitted over a WAN interface alternatively. Due to the conflicting nature of allow and disallow, only one of the above two choices can be made for each WAN interface. After the choice is made, you can define selection rules to "select" which packets will be allowed (or disallowed). Each packet selection rule consists of an IP protocol and set of local IP addresses/ports or an IPX Packet Type and a set of local IPX network number(s), node(s) and socket(s) a set of remote IP addresses/ports or remote IPX network numbers/nodes/ sockets The following table indicates the types of values that may be configured for each rule condition. 4-13 Protocol IP Condition Parameter Configuration Formats Protocol TCP/UDP/ ICMP/IGMP/ Any Single/Range/ Network/Any Single/Range/ Any Address Port IPX Packet Type Network Number Node Number Socket Single/Any Single/Range/ Any Single/Any Single/Range/ Any Therefore packet filtering simply defines sets of rules of what to allow or disallow through a set of parameters highlighted below: For IP, remote devices with IP addresses/port numbers are allowed (or disallowed) to communicate with local devices with IP addresses/port numbers over a WAN connection and using a specific IP protocol. For IPX, remote devices with IPX network numbers/nodes/sockets are allowed (or disallowed) to communicate with local devices with IPX network numbers/nodes/sockets over a WAN connection. Examples of packet filtering requirements are: 1. "I want to block any user in my remote office from being able to access my local NetWare server". The corresponding "translated" packet rule is: All IPX communication with my remote office is allowed EXCEPT remote devices with Any IPX network number and Any IPX node number and Any IPX socket which are disallowed from communicating with the local NetWare server (identified by its IPX network number, IPX Node Number and Any socket number over my specified remote office connection profile 4-14 using any IPX packet type. "I want to disallow people in the manufacturing department to access the Internet". The corresponding "translated" packet rule is: All access to the Internet is allowed EXCEPT remote devices with the range of IP addresses in the manufacturing department and any port number which are disallowed to communicate with any IP address/port number over my Internet connection using any IP protocol. Configuring IP Packet Rules To add a new IP packet rule or to edit an existing one, select IP Filter from the ARM menu: Configuration - Advanced - IP Filter Step 1 From the IP Filtering Configuration screen, select the WAN profile of interest from the pull down menu. For example, if your only need is to control access to the Internet, you should only select the Internet access profile. Step 2 Step 3 Select discarded or sent as the default action as desired, which is equivalent to disallow and allow, respectively. If you have previously defined rules, you will see those rules shown as entries in the rule table, and you can edit the rule by first highlighting the desired entry in the rule table followed by clicking the Edit button. 4-15 Step 4 In case of adding a new selection rule, the following screen shows: Step 5 Enter the following information: Rule No. : a number used for identification purposes. [. . . ] (2) Failure of the Product to perform in accordance with product specifications published by company (Product Performance). This Warranty is in lieu of all other express warranties that might otherwise arise with respect to the Product. No individual or organization of whatever form, connected to company or not, has authority to change or add to this Warranty. This Warranty does not apply to any failure of the Product which results from accident, abuse, misapplication, alteration, or failure due to attached equipment, and company assumes no liability as a consequence of such events under the terms of this Warranty. [. . . ]