Blocking Internet Sites (Content Filtering) - NETGEAR ProSafe FVS336G Reference Manual

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual
– Block UDP flood—A UDP flood is a form of denial of service attack in which the
attacking machine sends a large number of UDP packets to random ports to the victim
host. As a result, the victim host will check for the application listening at that port, see
that no application is listening at that port, and reply with an ICMP Destination
Unreachable packet.
When the victimized system is flooded, it is forced to send many ICMP packets,
eventually making it unreachable by other clients. The attacker may also spoof the IP
address of the UDP packets, ensuring that the excessive ICMP return packets do not reach
him, making the attacker's network location anonymous.
If flood checking is enabled, the VPN firewall will not accept more than 20 simultaneous,
active UDP connections from a single computer on the LAN.
– Disable Ping Reply on LAN Ports. To prevent the VPN firewall from responding to Ping
requests from the LAN, click this checkbox.
– Disable DNS Proxy. Whether DNS Proxy is enabled or disabled in the DHCP server
configuration (see
will service DNS requests sent to its own LAN IP address. To disable this service, check
this checkbox.
• VPN Pass through—When the FVS336G is in NAT mode, all packets going to the Remote
VPN Gateway are first filtered through NAT and then encrypted per the VPN policy.
If a VPN client or gateway on the LAN side of the VPN firewall wants to connect to another
VPN endpoint on the WAN, with the FVS336G between the two VPN end points, all
encrypted packets will be sent to the FVS336G. Since the FVS336G filters the encrypted
packets through NAT, the packets become invalid.
IPSec, PPTP, and L2TP represent different types of VPN tunnels that can pass through the
FVS336G. To allow the VPN traffic to pass through without filtering, enable those options for
the type of tunnel(s) that will pass through the FVS336G.

Blocking Internet Sites (Content Filtering)

To restrict internal LAN users from access to certain sites on the Internet, you can use the VPN
firewall's Content Filtering and Web Components filtering. By default, these features are disabled;
all requested traffic from any Web site is allowed. If you enable one or more of these features and
users try to access a blocked site, they will see a "Blocked by NETGEAR" message.
Several types of blocking are available:
4-20
"Configuring the LAN Setup Options" on page
v1.2, June 2008
3-2), the VPN firewall
Firewall Protection and Content Filtering