Chapter 7 Security - ZyXEL Communications PMG5318-B20B User Manual

The GPON Device firewall is a packet filtering firewall and restricts access based on the source/
destination computer network address of a packet and the type of application.
Basics
Computers share information over the Internet using a common language called TCP/IP. TCP/IP, in
turn, is a set of application protocols that perform specific functions. An "extension number", called
the "TCP port" or "UDP port" identifies these protocols, such as HTTP (Web), FTP (File Transfer
Protocol), POP3 (E-mail), etc. For example, Web traffic by default uses TCP port 80.
When computers communicate on the Internet, they are using the client/server model, where the
server "listens" on a specific TCP/UDP port for information requests from remote client computers
on the network. For example, a Web server typically listens on port 80. Please note that while a
computer may be intended for use over a single port, such as Web on port 80, other ports are also
active. If the person configuring or managing the computer is not careful, a hacker could attack it
over an unprotected port.
Some of the most common IP ports are:
Table 28 Common IP Ports
21 FTP
23 Telnet
25 SMTP
Default Filtering Policies
Filtering rules are grouped based on the direction of travel of packets to which they apply.
The default outgoing filtering rule is that all users on the LAN are allowed non-restricted access to
the WAN. You may define additional rules. When you configure an outgoing filtering rule, you in
essence want to limit some or all users from accessing certain services or IP addresses on the WAN.
The default rule for incoming traffic blocks all incoming connections from the WAN to the LAN. If
you wish to allow certain WAN users to have access to your LAN, you will need to create custom
rules to allow it.
Note: If you configure filtering rules without a good understanding of how they work, you
might inadvertently introduce security risks to the firewall and to the protected
network. Make sure you test your rules after you configure them.
For example, you may create rules to:
• Allow certain types of traffic, such as Lotus Notes database synchronization, from specific hosts
on the Internet to specific hosts on the LAN.
C
H A PT ER
53 DNS
80 HTTP
110 POP3
PMG5318-B20B User's Guide
47
7
Security