Packet Filtering Vs Firewall - ZyXEL Communications ZyXEL ZyWALL 2WE User Manual

ZyWALL 2 and ZyWALL 2WE
7. Keep the firewall in a secured (locked) room.

13.7 Packet Filtering Vs Firewall

Below are some comparisons between the ZyWALL's filtering and firewall functions.
13.7.1 Packet Filtering:
The router filters packets as they pass through the router's interface according to the filter rules you
designed.
Packet filtering is a powerful tool, yet can be complex to configure and maintain, especially if you need
a chain of rules to filter a service.
Packet filtering only checks the header portion of an IP packet.
When To Use Filtering
1. To block/allow LAN packets by their MAC addresses.
2. To block/allow special IP packets which are neither TCP nor UDP, nor ICMP packets.
3. To block/allow both inbound (WAN to LAN) and outbound (LAN to WAN) traffic between the specific
inside host/network "A" and outside host/network "B". If the filter blocks the traffic from A to B, it also
blocks the traffic from B to A. Filters cannot distinguish traffic originating from an inside host or an
outside host by IP address.
4. To block/allow IP trace route.
13.7.2 Firewall
The firewall inspects packet contents as well as their source and destination addresses. Firewalls of this
type employ an inspection module, applicable to all protocols, that understands data in the packet is
intended for other layers, from the network layer (IP headers) up to the application layer.
The firewall performs stateful inspection. It takes into account the state of connections it handles so that,
for example, a legitimate incoming packet can be matched with the outbound request for that packet and
allowed in. Conversely, an incoming packet masquerading as a response to a nonexistent outbound
request can be blocked.
The firewall uses session filtering, i.e., smart rules, that enhance the filtering process and control the
network session rather than control individual packets in a session.
The firewall provides e-mail service to notify you of routine reports and when alerts occur.
13-12 Firewalls