Filter
How does ZyXEL filter work?
The Prestige allows you to configure up to twelve filter sets with six rules in each set, for a total of 72 filter rules in the system. You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port. The following diagram illustrates the logic flow when executing a filter rule.
Conceptually, there are two categories of filter rules: device
and protocol. The Generic filter rules belong to the
device category; they act on the raw data from/to LAN and WAN. The IP and IPX filter rules
belong to the protocol category; they act on the IP and IPX packets.
In order to allow users to specify the local network IP address and port number in the filter rules with SUA connections, the TCP/IP filter function has to be executed before SUA for WAN outgoing packets and after the SUA for WAN incoming IP packets. But at the same time, the Generic filter rules must be applied at the point when the Prestige is receiving and sending the packets; i.e. the ISDN interface. So, the execution sequence has to be changed. The logic flow of the filter is shown in Figure 1 and the sequence of the logic flow for the packet from LAN to WAN is:
The sequence of the logic flow for the packet from WAN to LAN is:
WAN device input filter sets.
If SUA is enabled, SUA converts the destination IP address from 203.205.115.6 to 92.168.1.33 and port number from 4034 to 1023.
WAN protocol input filter sets.
LAN device and protocol output filter sets.
Generic and TCP/IP (and IPX) filter rules are in different filter sets. The SMT will detect and prevent the mixing of different category rules within any filter set in Menu 21. In the following example, you will receive an error message 'Protocol and device filter rules cannot be active together' if you try to activate a TCP/IP (or IPX) filter rule in a filter set that has already had one or more active Generic filter rules. You will receive the same error if you try to activate a Generic filter rule in a filter set that has already had one or more active TCP/IP (or IPX) filter rules.
Menu 21.1.1:
Menu 21.1.1 - Generic Filter Rule
Filter #: 1,1
|
Menu 21.1.2:
Menu 21.1.2 - TCP/IP Filter Rule
Filter #: 1,2
Press ENTER to Confirm or ESC to Cancel: |
To separate the device and protocol filter categories; two new menus, Menu 11.5 and Menu 13.1, have been added, as well as some changes made to the Menu 3.1, Menu 11.1, and Menu 13. The new fields are shown below.
Menu 3.1:
Menu 3.1 - General Ethernet Setup
Input Filter Sets:
|
Menu 11.1:
|
Menu 11.5:
Menu 11.5 - Remote Node Filter
Input Filter Sets: |
SMT will also prevent you from entering a protocol filter set configured in Menu 21 to the device filters field in Menu 3.1, 11.5, or entering a device filter set to the protocol filters field. Even though SMT will prevent the inconsistency from being entered in ZyNOS, it is unable to resolve the intermixing problems existing in the filter sets that were configured before. Instead, when ZyNOS translates the old configuration into the new format, it will verify the filter rules and log the inconsistencies. Please check the system log (Menu 24.3.1) before putting your device into use.
In order to avoid operational problems later, the Prestige
will disable its routing/bridging functions if there is an inconsistency among its filter
rules.