DrayTek Vigor-2930n Router Manual PDF (Setup & Configuration Guide)

Page 71 / 298 Scroll up to view Page 66 - 70

igor2930 Series User’s Guide

63

specify some IP addresses in the IP Alias List of the Static/DHCP

Configuration page first. If you did not type in any IP address in

the IP Alias List, the Public IP setting will be empty in this field.

When you click

Apply

, a message will appear to inform you.

Private IP

Assign an IP address (e.g., 192.168.1.10) or a subnet to be

compared with the Public IP address for incoming packets.

Subnet Mask

Select a value of subnet mask for private IP address.

3.4 Firewall

3.4.1 Basics for Firewall

While the broadband users demand more bandwidth for multimedia, interactive applications,

or distance learning, security has been always the most concerned. The firewall of the Vigor

router helps to protect your local network against attack from unauthorized outsiders. It also

restricts users in the local network from accessing the Internet. Furthermore, it can filter out

specific packets that trigger the router to build an unwanted outgoing connection.

Firewall Facilities

The users on the LAN are provided with secured protection by the following firewall

facilities:

z

User-configurable IP filter (Call Filter/ Data Filter).

z

Stateful Packet Inspection (SPI): tracks packets and denies unsolicited incoming data

z

Selectable Denial of Service (DoS) /Distributed DoS (DDoS) attacks protection

IP Filters

Depending on whether there is an existing Internet connection, or in other words “the WAN

link status is up or down”, the IP filter architecture categorizes traffic into two:

Call Filter

and

Data Filter

.

z

Call Filter -

When there is no existing Internet connection,

Call Filter

is applied to all

traffic, all of which should be outgoing. It will check packets according to the filter

rules. If legal, the packet will pass. Then the router shall

“initiate a call”

to build the

Internet connection and send the packet to Internet.

z

Data Filter

- When there is an existing Internet connection,

Data Filter

is applied to

incoming and outgoing traffic. It will check packets according to the filter rules. If legal,

the packet will pass the router.

Page 72 / 298

Vigor2930 Series User’s Guide

64

The following illustrations are flow charts explaining how router will treat incoming traffic

and outgoing traffic respectively.

Stateful Packet Inspection (SPI)

Stateful inspection is a firewall architecture that works at the network layer. Unlike legacy

static packet filtering, which examines a packet based on the information in its header,

stateful inspection builds up a state machine to track each connection traversing all interfaces

of the firewall and makes sure they are valid. The stateful firewall of Vigor router not just

examine the header information also monitor the state of the connection.

Denial of Service (DoS) Defense

The

DoS Defense

functionality helps you to detect and mitigate the DoS attack. The attacks

are usually categorized into two types, the flooding-type attacks and the vulnerability attacks.

The flooding-type attacks will attempt to exhaust all your system's resource while the

vulnerability attacks will try to paralyze the system by offending the vulnerabilities of the

protocol or operation system.

The

DoS Defense

function enables the Vigor router to inspect every incoming packet based

on the attack signature database. Any malicious packet that might duplicate itself to paralyze

the host in the secure LAN will be strictly blocked and a Syslog message will be sent as

warning, if you set up Syslog server.

Also the Vigor router monitors the traffic. Any abnormal traffic flow violating the pre-defined

parameter, such as the number of thresholds, is identified as an attack and the Vigor router

will activate its defense mechanism to mitigate in a real-time manner.

The below shows the attack types that DoS/DDoS defense function can detect:

1. SYN flood attack

9. Smurf attack

Page 73 / 298

igor2930 Series User’s Guide

65

2. UDP flood attack

3. ICMP flood attack

4. TCP Flag scan

5. Trace route

6. IP options

7. Unknown protocol

8. Land attack

10. SYN fragment

11. ICMP fragment

12. Tear drop attack

13. Fraggle attack

14. Ping of Death attack

15. TCP/UDP port scan

Below shows the menu items for Firewall.

3.4.2 General Setup

General Setup allows you to adjust settings of IP Filter and common options.

Here you can

enable or disable the

Call Filter

or

Data Filter

. Under some circumstance, your filter set can

be linked to work in a serial manner. So here you assign the

Start Filter Set

only. Also you

can configure the

Log Flag

settings,

Apply IP filter to VPN incoming packets

, and

Accept

incoming fragmented UDP packets

.

Click

Firewall

and click

General Setup

to open the general setup page.

Call Filter

Check

Enable

to activate the Call Filter function. Assign a start

filter set for the Call Filter.

Data Filter

Check

Enable

to activate the Data Filter function. Assign a start

filter set for the Data Filter.

Action/Profile

Select

Pass

or

Block

for the packets that do not match with the

Page 74 / 298

Vigor2930 Series User’s Guide

66

filter rules.

APP Enforcement

Select one of the

APP Enforcement

settings (created in

CSM>>

APP Enforcement Profile Filter

) for applying with this router.

Please set at least one profile for choosing in

CSM>> APP

Enforcement Profile

web page first. For troubleshooting needs,

you can specify to record information for

APP Enforcement

Profile

by checking the Log box. It will be sent to Syslog server.

Please refer to section

Syslog/Mail Alert

for more detailed

information.

URL Content Filter

Select one of the

URL Content Filter

Profile

settings (created

in

CSM>> URL Content Filter Profile

) for applying with this

router. Please set at least one profile for choosing in

CSM>>

URL Content Filter

Profile

web page first. For troubleshooting

needs, you can specify to record information for

URL Content

Filter

by checking the Log box. It will be sent to Syslog server.

Please refer to section

Syslog/Mail Alert

for more detailed

information.

Web Content Filter

Select one of the

Web Content Filter

Profile

settings (created in

CSM>> Web Content Filter Profile

) for applying with this

router. Please set at least one profile for anti-virus in

CSM>>

Web Content Filter Profile

web page first. For troubleshooting

needs, you can specify to record information for

Web Content

Filter

Profile

by checking the Log box. It will be sent to Syslog

server. Please refer to section

Syslog/Mail Alert

for more

detailed information.

Syslog

For troubleshooting needs you can specify the filter log and/or

CSM log here by checking the box. The log will be displayed on

Draytek Syslog window.

Advance Setting

Click

Edit

to open the following window. However, it is

strongly recommended

to use the default settings here.

Codepage

- This function is used to compare the characters

among different languages. Choose correct codepage can help

the system obtaining correct ASCII after decoding data from

URL and enhance the correctness of URL Content Filter. The

default value for this setting is ANSI 1252 Latin I. If you do not

choose any codepage, no decoding job of URL will be processed.

Please use the drop-down list to choose a codepage.

If you do not have any idea of choosing suitable codepage,

please open Syslog. From Codepage Information of Setup dialog,

you will see the recommended codepage listed on the dialog box.

Page 75 / 298

igor2930 Series User’s Guide

67

Window size

– It determines the size of TCP protocol

(0~65535). The more the value is, the better the performance will

be. However, if the network is not stable, small value will be

proper.

Session timeout

–Setting timeout for sessions can make the best

utilization of network resources. However, Queue timeout is

configured for TCP protocol only; session timeout is configured

for the data flow which matched with the firewall rule.

Accept large

incoming…

Some on-line games (for example: Half Life) will use lots of

fragmented UDP packets to transfer game data. Instinctively as a

secure firewall, Vigor router will reject these fragmented packets

to prevent attack unless you enable “

Accept large incoming

fragmented UDP or ICMP Packets

”. By checking this box, you

can play these kinds of on-line games. If security concern is in

higher priority, you cannot enable “

Accept large incoming

fragmented UDP or ICMP Packets

”.

Enable Transparent

Mode

Check this box to enable transparent function for such router. It

is not necessary for users to re-organize the network or configure

the subnet settings for each PC connected under such router.

However, the configured Anti-Virus and Anti-Intrusion profiles

can be applied to PCs connected behind vigor router to have the

best security. The following picture explains the basic structure

for using transparent mode for vigor router.

Rate

Popular DrayTek Models

Famous Router IPs

Famous Router Companies

Bookmark Our Site

Share