Filter
How does ZyXEL filter work?
Conceptually, there are two categories of filter rules: device
and protocol. The Generic filter rules belong to the
device category; they act on the raw data from/to LAN and WAN. The IP and IPX filter rules
belong to the protocol category; they act on the IP and IPX packets.
In order to allow users to specify the local network IP address and port number in the filter rules with SUA connections, the TCP/IP filter function has to be executed before SUA for WAN outgoing packets and after the SUA for WAN incoming IP packets. But at the same time, the Generic filter rules must be applied at the point when the Prestige is receiving and sending the packets; i.e. the ISDN interface. So, the execution sequence has to be changed. The logic flow of the filter is shown in Figure 1 and the sequence of the logic flow for the packet from LAN to WAN is:
The sequence of the logic flow for the packet from WAN to LAN is:
WAN device input filter sets.
If SUA is enabled, SUA converts the destination IP address from 203.205.115.6 to 92.168.1.33 and port number from 4034 to 1023.
WAN protocol input filter sets.
LAN device and protocol output filter sets.
Generic and TCP/IP (and IPX) filter rules are in different filter sets. The SMT will detect and prevent the mixing of different category rules within any filter set in Menu 21. In the following example, you will receive an error message 'Protocol and device filter rules cannot be active together' if you try to activate a TCP/IP (or IPX) filter rule in a filter set that has already had one or more active Generic filter rules. You will receive the same error if you try to activate a Generic filter rule in a filter set that has already had one or more active TCP/IP (or IPX) filter rules.
Menu 21.1.1:
Menu 21.1.1 - Generic Filter Rule
Filter #: 1,1
|
Menu 21.1.2:
Menu 21.1.2 - TCP/IP Filter Rule
Filter #: 1,2
Press ENTER to Confirm or ESC to Cancel: |
To separate the device and protocol filter categories; two new menus, Menu 11.5 and Menu 13.1, have been added, as well as some changes made to the Menu 3.1, Menu 11.1, and Menu 13. The new fields are shown below.
Menu 3.1:
Menu 3.1 - General Ethernet Setup
Input Filter Sets:
|
Menu 11.1:
Menu 11.1 - Remote Node Profile Rem Node Name= abc
Edit PPP Options= No Press ENTER to Confirm or ESC to Cancel:
|
Menu 11.5:
Menu 11.5 - Remote Node Filter
Input Filter Sets:
|
Menu 13:
Menu 13 - Default Dial-in Setup Telco Options:
IP Address Supplied By: Press ENTER to Confirm or ESC to Cancel:
|
Menu 13.1:
Menu 13.1 - Default Dial-in Filter
Input Filter Sets:
|
SMT will also prevent you from entering a protocol filter set configured in Menu 21 to the device filters field in Menu 3.1, 11.5, or 13.1, or entering a device filter set to the protocol filters field. Even though SMT will prevent the inconsistency from being entered in ZyNOS, it is unable to resolve the intermixing problems existing in the filter sets that were configured before. Instead, when ZyNOS translates the old configuration into the new format, it will verify the filter rules and log the inconsistencies. Please check the system log (Menu 24.3.1) before putting your device into use.
Running the Prestige with wrong filter rules may cause it to keep the ISDN line perpetually active, and/or allow undesired traffic to pass to the outside world, and receive unwanted outside traffic. The first case may incur an enormous ISDN bill; the second may lead to a data security hazard.
In order to avoid operational problems later, the Prestige
will disable its routing/bridging functions if there is an inconsistency among its filter
rules.
All contents copyright © 1999 ZyXEL Communications Corporation.