Table of Contents
Advertisement
When to use filtering
1
To block or allow LAN packets by their MAC addresses.
2
To block or allow special IP packets that are neither TCP nor UDP, nor ICMP
packets.
3
To block or allow both inbound (WAN to LAN) and outbound (LAN to
WAN) traffic between the specific inside host or network A and outside host
or network B. If the filter blocks the traffic from A to B, it also blocks the
traffic from B to A. Filters cannot distinguish traffic originating from an
inside host or an outside host by IP address.
4
To block or allow IP trace route.
Firewall
•
The firewall inspects packet contents as well as their source and destination
addresses. Firewalls of this type employ an inspection module, applicable to
all protocols, that understands data in the packet is intended for other layers,
from the network layer (IP headers) up to the application layer.
•
The firewall performs stateful inspection. It takes into account the state of the
connections it handles, so that, for example, a legitimate incoming packet can
be matched with the outbound request for that packet and allowed in.
Conversely, an incoming packet masquerading as a response to a nonexistent
outbound request can be blocked.
•
The firewall uses session filtering, or smart rules, that enhance the filtering
process and control the network session rather than control individual packets
in a session.
•
The firewall provides e-mail service to notify you of routine reports and when
alerts occur.
When to use the firewall
1
To prevent DoS attacks and prevent hackers cracking your network.
2
A range of source and destination IP addresses as well as port numbers can be
specified within one firewall rule, making the firewall a better choice when
complex rules are required.
3
To selectively block or allow inbound or outbound traffic between inside host
or networks and outside host or networks. Remember that filters cannot
Nortel Business Secure Router 252 Configuration — Basics
Chapter 10 Firewalls 167
Advertisement
Table of Contents
Troubleshooting
