Filter Types And Sua; Applying A Filter And Factory Defaults; Ethernet Traffic; Figure 9-13 Protocol And Device Filter Sets - ZyXEL Communications Prestige 681 User Manual

Prestige 681 SDSL Router
9.5

Filter Types and SUA

There are two classes of filter rules, Generic Filter (Device) rules and Protocol Filter (TCP/IP and IPX)
rules. Generic Filter rules act on the raw data from/to LAN and WAN. Protocol Filter rules act on the IP
and IPX packets. Generic and TCP/IP filter rules are discussed in more detail in the next section. When
NAT/SUA (Network Address Translation/Single User Account) is enabled, the inside IP address and port
number are replaced on a connection-by-connection basis, which makes it impossible to know the exact
address and port on the wire. Therefore, the Prestige applies the protocol filters to the "native" IP address
and port number before NAT/SUA for outgoing packets and after NAT/SUA for incoming packets. On the
other hand, the generic, or device filters are applied to the raw packets that appear on the wire. They are
applied at the point when the Prestige is receiving and sending the packets; i.e. the interface. The interface
can be an Ethernet port or any other hardware port. The following diagram illustrates this.
9.6

Applying a Filter and Factory Defaults

This section shows you where to apply the filter(s) after you design it (them). Three sets of factory default
filter rules have been configured in Menu 21 to prevent NetBIOS traffic from triggering calls and to prevent
incoming telnetting.

9.6.1 Ethernet traffic

You seldom need to filter Ethernet traffic; however, the filter sets may be useful to block certain packets,
reduce traffic and prevent security breaches. Go to Menu 3.1 (shown below) and enter the number(s) of the
filter set(s) that you want to apply as appropriate. You can choose up to four filter sets (from twelve) by
entering their numbers separated by commas, e.g., 3, 4, 6, 11. The factory default filter set, NetBIOS_LAN,
is inserted in the protocol filters field under Input Filter Sets in Menu 3.1 in order to prevent local
NetBIOS messages from triggering calls to the DNS server
9-18
Figure 9-13 Protocol and Device Filter Sets
Filter Configuration