Stateful Inspection And The Zyxel Device; Tcp Security - ZyXEL Communications VANTAGE CNM User Manual

12.4.2 Stateful Inspection and the ZyXEL device

Additional rules may be defined to extend or override the default rules. For example, a rule
may be created which will:
1 Block all traffic of a certain type, such as IRC (Internet Relay Chat), from the LAN to the
Internet.
2 Allow certain types of traffic from the Internet to specific hosts on the LAN.
3 Allow access to a Web server to everyone but competitors.
4 Restrict use of certain protocols, such as Telnet, to authorized users on the LAN.
These custom rules work by evaluating the network traffic's Source IP address, Destination IP
address, IP protocol type, and comparing these to rules set by the administrator.
Below is a brief technical description of how these connections are tracked. Connections may
either be defined by the upper protocols (for instance, TCP), or by the ZyXEL device itself (as
with the "virtual connections" created for UDP and ICMP).
12.4.3

TCP Security

The ZyXEL device uses state information embedded in TCP packets. The first packet of any
new connection has its SYN flag set and its ACK flag cleared; these are "initiation" packets.
All packets that do not have this flag structure are called "subsequent" packets, since they
represent data that occurs later in the TCP stream.
If an initiation packet originates on the WAN, this means that someone is trying to make a
connection from the Internet into the LAN. Except in a few special cases (see "Upper Layer
Protocols" shown next), these packets are dropped and logged.
If an initiation packet originates on the LAN, this means that someone is trying to make a
connection from the LAN to the Internet. Assuming that this is an acceptable part of the
security policy (as is the case with the default policy), the connection will be allowed. A cache
entry is added which includes connection information such as IP addresses, TCP ports,
sequence numbers, etc.
When the ZyXEL device receives any subsequent packet (from the Internet or from the LAN),
its connection information is extracted and checked against the cache. A packet is only
allowed to pass through if it corresponds to a valid connection (that is, if it is a response to a
connection which originated on the LAN).
Chapter 12 Configuration > Firewall
Note: The ability to define firewall rules is a very powerful tool.
Using custom rules, it is possible to disable all firewall
protection or block all access to the Internet. Use extreme
caution when creating or deleting firewall rules. Test changes
after creating them to make sure they work correctly.
Vantage CNM User's Guide
176