Netopia 3346N-ENT User Guide (en)

Download
10-22  Firmware User Guide
Blocks (discards) the packet
Ignores the packet
A filter for wards or blocks a packet only if it finds a match after applying its criteria. When no match occurs, the 
filter ignores the packet.
A filtering rule
The criteria are based on information contained in the packets. A filter is simply a rule that prescribes cer tain 
actions based on cer tain conditions. For example, the following rule qualifies as a filter:
Block all Telnet attempts that originate from the remote host 199.211.211.17.
This rule applies to Telnet packets that come from a host with the IP address 199.211.211.17. If a match 
occurs, the packet is blocked.
Here is what this rule looks like when implemented as a filter on the Netopia Firmware Version 8.6.1:
To understand this par ticular filter, look at the par ts of a filter.
Parts of a filter
A filter consists of criteria based on packet attributes. A typical filter can match a packet on any one of the 
following attributes:
The source IP address (where the packet was sent from)
The destination IP address (where the packet is going)
The type of higher-layer Internet protocol the packet is carr ying, such as TCP or UDP
Port numbers
A filter can also match a packet’s por t number attributes, but only if the filter’s protocol type is set to TCP or 
UDP, since only those protocols use por t numbers. The filter can be configured to match the following:
The source por t number (the por t on the sending host that originated the packet)
The destination por t number (the por t on the receiving host that the packet is destined for)
By matching on a por t number, a filter can be applied to selected TCP or UDP ser vices, such as Telnet, FTP, and 
World Wide Web. The following tables show a few common ser vices and their associated por t numbers:
Internet service
TCP port
Internet service
TCP port
FTP
20/21
Finger
79
Telnet
23
World Wide Web
80
  +-#--Source IP Addr--Dest IP Addr-----Proto-Src.Port-D.Port--On?-Fwd-+
  +--------------------------------------------------------------------+
  | 1  199.211.211.17  0.0.0.0          TCP   23               Yes No  |
  +--------------------------------------------------------------------+