Draytek Vigor2500V Manual page 61

Firewall
6.2 An Overview of the Firewall
The Firewall Setup in the Vigor router mainly consists of the packet
filtering, DoS (Denial of Service) defense, and URL (Universal
Resource Locator) content filtering facilities. In this chapter, we focus
on the introduction of the packet filtering function. In the Supplement
A and B chapters, we will explain more about DoS defense and URL
content filtering facilities.
The packet filtering function contains, by default, two types of filter
sets: Call Filter set and Data Filter set. The Call Filter is used for users
that attempt to establish a connection from LAN side to the Internet.
The Data Filter set is used to determine what kind of IP packets is
allowed to pass through the router when the WAN connection has
been established.
Conceptually, when an outgoing packet is to be routed to the WAN,
the IP Filter will decide if the packet should be forwarded to the Call
Filter or Data Filter. If the WAN link is down, the packet will enter the
Call Filter. If the packet is not allowed to trigger router dialing, it will be
dropped. Otherwise, it will initiate a call to establish the WAN
connection.
If the WAN link of the router is up, the packet will pass through the
Data Filter. If the packet type is set to be blocked, it will be dropped.
Otherwise, it will be sent to the WAN interface. Alternatively, if an
incoming packet enters from the WAN interface, it will pass through
the Data Filter directly. If the packet type is set to be blocked, it will be
dropped. Otherwise, it will be sent to the internal LAN. The filter
architecture is shown below.
6-2