Netopia 3346N-ENT User Guide (en)

Download
10-40  Firmware User Guide
and a packet goes through these rules destined for FTP, the packet would for ward through the first filter rule 
(WWW), match the second rule (FTP), and the packet is allowed through. Even though the next rule is to deny all 
FTP traffic, the FTP packet will never make it to this rule.
Binary representation
It is easiest when doing filtering to conver t the IP address and mask in question to binar y. This will allow you to 
per form the logical AND to determine whether a packet matches a filter rule.
Logical AND function
When a packet is compared (in most cases) a logical AND function is per formed. First the IP addresses and 
subnet masks are conver ted to binar y and then combined with AND. The rules for the logical use of AND are as 
follows:
0 AND 0 = 0
0 AND 1 = 0
1 AND 0 = 0
1 AND 1 = 1
For example:
Filter rule:
Deny
IP: 163.176.1.15BINARY:
10100011.10110000.00000001.00001111
Mask: 255.255.255.255BINARY:11111111.11111111.11111111.11111111
Incoming Packet:
IP 163.176.1.15BINARY:
10100011.10110000.00000001.00001111
If you put the incoming packet and subnet mask together with AND, the result is:
10100011.10110000.00000001.00001111
which matches the IP address in the filter rule and the packet is denied.
Implied rules
With a given set of filter rules, there is an Implied rule that may or may not be shown to the user. The implied 
rule tells the filter set what to do with a packet that does not match any of the filter rules. An example of implied 
rules is as follows:
Implied
Meaning
Y+Y+Y=N
If all filter rules are YES, the implied rule is NO.
N+N+N=Y
If all filter rules are NO, the implied rule is YES.
Y+N+Y=N
If a mix of YES and NO filters, the implied rule is NO.