Motorola Netopia-3000 Router Manual PDF (Setup & Configuration Guide)

Page 161 / 351 Scroll up to view Page 156 - 160

161

Firewall Tutorial

•

Source IP Address = 199.211.211.17

•

Source IP address mask = 255.255.255.255

•

Destination IP Address = 0.0.0.0

•

Destination IP address mask = 0.0.0.0

•

Using the tables on

page 158

, ﬁnd the destination port and protocol numbers (the

local

Telnet port):

•

Protocol = TCP (or 6)

•

Destination Port = 23

•

The ﬁlter should be enabled and instructed to block the Telnet packets containing the

source address shown in step 2:

•

Forward = unchecked

This four-step process is how we produced the following ﬁlter from the original rule:

Page 162 / 351

162

Filtering example #2

Suppose a ﬁlter is conﬁgured to block all incoming IP packets with the source IP address of

200.233.14.0, regardless of the type of connection or its destination. The ﬁlter would look

like this:

This ﬁlter blocks any packets coming from a remote network with the IP network address

200.233.14.0. The 0 at the end of the address signiﬁes

any

host on the class C IP net-

work 200.233.14.0. If, for example, the ﬁlter is applied to a packet with the source IP

address 200.233.14.5, it will block it.

In this case, the mask, must be set to 255.255.255.0. This way, all packets with a source

address of 200.233.14.x will be matched correctly, no matter what the ﬁnal address byte

is.

☛

Note:

The protocol attribute for this ﬁlter is

Any

by default. This tells the ﬁlter to

ignore the IP protocol or type of IP packet.

Page 163 / 351

163

Firewall Tutorial

Design guidelines

Careful thought must go into designing a new ﬁlter set. You should consider the following

guidelines:

•

Be sure the ﬁlter set’s overall purpose is clear from the beginning. A vague purpose can

lead to a faulty set, and that can actually make your network

less

secure.

•

Be sure each individual ﬁlter’s purpose is clear.

•

Determine how ﬁlter priority will affect the set’s actions. Test the set (on paper) by

determining how the ﬁlters would respond to a number of different hypothetical pack-

ets.

•

Consider the combined effect of the ﬁlters. If every ﬁlter in a set fails to match on a par-

ticular packet, the packet is:

•

Forwarded if all the ﬁlters are conﬁgured to discard (

not

forward)

•

Discarded if all the ﬁlters are conﬁgured to forward

•

Discarded if the set contains a combination of forward and discard ﬁlters

An approach to using ﬁlters

The ultimate goal of network security is to prevent unauthorized access to the network with-

out compromising authorized access. Using ﬁlter sets is part of reaching that goal.

Each ﬁlter set you design will be based on one of the following approaches:

•

That which is not expressly prohibited is permitted.

•

That which is not expressly permitted is prohibited.

It is strongly recommended that you take the latter, and safer, approach to all of your ﬁlter

set designs.

Page 164 / 351

164

Working with IP Filters and Filter Sets

To work with ﬁlters and ﬁlter sets, begin by accessing the ﬁlter set pages.

☛

NOTE:

Make sure you understand how ﬁlters work before attempting to use them.

Read the section

“Packet Filter” on page 154

.

The procedure for creating and maintaining ﬁlter sets is as follows:

1.

Add a new ﬁlter set.

See

Adding a ﬁlter set

, below.

2.

Create the ﬁlters for the new ﬁlter set.

See

“Adding ﬁlters to a ﬁlter set” on page 165

.

3.

Associate the ﬁlter set with either the LAN or WAN interface.

See

“Associating a Filter Set with an Interface” on page 171

.

The sections below explain how to execute these steps.

Adding a ﬁlter set

You can create up to eight different custom ﬁlter sets. Each ﬁlter set can contain up to 16

output ﬁlters and up to 16 input ﬁlters. There can be a maximum of 32 ﬁlter rules in the

system.

To add a new ﬁlter set, click the

Ad

d

button in the Filter Sets page. The Add Filter Set page

appears.

Page 165 / 351

165

Working with IP Filters and Filter Sets

Enter new name for the ﬁlter set, for example

Filter Set 1

.

To save the ﬁlter set, click the

Submit

button. The saved ﬁlter set is empty (contains no

ﬁlters), but you can return to it later to add ﬁlters (see “

Adding ﬁlters to a ﬁlter set”

).

☛

NOTE:

As you begin to build a ﬁlter set, and as you add ﬁlters, after your ﬁrst entry,

the Alert icon

will appear in the upper right corner of the web page. It will

remain until all of your changes are entered and validated. You need not imme-

diately restart the Gateway until your ﬁlter set is complete. See

“Associating a

Filter Set with an Interface” on page 171

.

Adding ﬁlters to a ﬁlter set

There are two kinds of ﬁlters you can add to a ﬁlter set: input and output. Input ﬁlters

check packets received from the Internet, destined for your network. Output ﬁlters check

packets transmitted from your network to the Internet.

Rate

Popular Motorola Models

Famous Router IPs

Famous Router Companies

Bookmark Our Site

Share