Netopia Firmware 4000-Series Software Manual page 256

10-32 Firmware User Guide
Basic Firewall blocks undesirable traffic originating from the WAN (in most cases, the Internet), but forwards all
traffic originating from the LAN. It follows the conservative "that which is not expressly permitted is prohibited"
approach: unless an incoming packet expressly matches one of the constituent input filters, it will not be
forwarded to the LAN.
The five input filters and one output filter that make up Basic Firewall are shown in the table below.
Setting
Enabled
Forward
Source IP
address
Source IP
address mask
Dest. IP
address
Dest. IP
address mask
Protocol type
Source port
comparison
Source port ID
Dest. port
comparison
Dest. port ID
Basic Firewall's filters play the following roles.
Input filters 1 and 2: These block WAN-originated OpenWindows and X-Windows sessions. Service origination
requests for these protocols use ports 2000 and 6000, respectively. Since these are greater than 1023,
OpenWindows and X-Windows traffic would otherwise be allowed by input filter 4. Input filters 1 and 2 must
precede input filter 4; otherwise they would have no effect since filter 4 would have already forwarded
OpenWindows and X-Windows traffic.
Input filter 3: This filter explicitly forwards all WAN-originated ICMP traffic to permit devices on the WAN to ping
devices on the LAN. Ping is an Internet service that is useful for diagnostic purposes.
Input filters 4 and 5: These filters forward all TCP and UDP traffic, respectively, when the destination port is
greater than 1023. This type of traffic generally does not allow a remote host to connect to the LAN using one
of the potentially intrusive Internet services, such as Telnet, FTP, and WWW.
Input filter Input filter
1 2
Yes Yes
No No
0.0.0.0 0.0.0.0
0.0.0.0 0.0.0.0
0.0.0.0 0.0.0.0
0.0.0.0 0.0.0.0
TCP TCP
No No
Compare Compare
0 0
Equal Equal
2000 6000
Input filter Input filter
3 4
Yes Yes
Yes Yes
0.0.0.0 0.0.0.0
0.0.0.0 0.0.0.0
0.0.0.0 0.0.0.0
0.0.0.0 0.0.0.0
ICMP TCP
N/A No
Compare
N/A 0
N/A Greater
Than
N/A 1023
Input filter Output
5 filter 1
Yes Yes
Yes Yes
0.0.0.0 0.0.0.0
0.0.0.0 0.0.0.0
0.0.0.0 0.0.0.0
0.0.0.0 0.0.0.0
UDP 0
No N/A
Compare
0 N/A
Greater N/A
Than
1023 N/A