76

Field Name

Sample value

Explanation

1.

Enable SYN flood protection

Enable/Disable

Makes router more resistant to SYN flood attacks.

2.

SYN flood rate

“25”

Set rate limit (packets/second) for SYN packets above

which the traffic is considered a flood.

3.

SYN flood burst

“50”

Set burst limit for SYN packets above which the traffic is

considered a flood if it exceeds the allowed rate.

4.

TCP SYN cookies

Enable/Disable

Enable the use of SYN cookies (particular choices of

initial TCP sequence numbers by TCP servers).

7.6.6.2

Remote ICMP requests

Attackers are using ICMP echo request packets directed to IP broadcast addresses from remote locations to

generate denial-of-service attacks.

Field Name

Sample value

Explanation

1.

Enable ICMP requests

Enable/Disable

Blocks remote ICMP echo-request type

2.

Enable ICMP limit

Enable/Disable

Enable ICMP echo-request limit in selected period

3.

Limit period

Second/Minute/Hour/Day

Select in what period limit ICMP echo-request

4.

Limit

“10”

Maximum ICMP echo-request during the period

5.

Limit burst

“5”

Indicating the maximum burst before the above limit

kicks in.

77

7.6.6.3

SSH Attack Prevention

Prevent SSH (Allows a user to run commands on a machine's command prompt without them being physically

present near the machine.) attacks by limiting connections in defined period.

Field Name

Sample value

Explanation

1.

Enable SSH limit

Enable/Disable

Enable SSH connections limit in selected period

2.

Limit period

Second/Minute/Hour/Day

Select in what period limit SSH connections

3.

Limit

“10”

Maximum SSH connections during the period

4.

Limit burst

“5”

Indicating the maximum burst before the above limit

kicks in.

7.6.6.4

HTTP Attack Prevention

HTTP attack sends a complete, legitimate HTTP header, which includes a 'Content-Length' field to specify the size

of the message body to follow. However, the attacker then proceeds to send the actual message body at an extremely

slow rate (e.g. 1 byte/110 seconds). Due to the entire message being correct and complete, the target server will

attempt to obey the 'Content-Length' field in the header, and wait for the entire body of the message to be transmitted,

hence slowing it down.

Field Name

Sample value

Explanation

1.

Enable HTTP limit

Enable/Disable

Limits HTTP connections per period

2.

Limit period

Second/Minute/Hour/Day

Select in what period limit HTTP connections

3.

Limit

“10”

Maximum HTTP connections during the period

4.

Limit burst

“10”

Indicating the maximum burst before the above limit

kicks in.

78

7.6.6.5

HTTPS Attack Prevention

Field Name

Sample value

Explanation

1.

Enable HTTPS limit

Enable/Disable

Limits HTTPS connections per period

2.

Limit period

Second/Minute/Hour/Day

Select in what period limit HTTPS connections

3.

Limit

“10”

Maximum HTTPS connections during the period

4.

Limit burst

“10”

Indicating the maximum burst

7.6.7

Port Scan Prevention

7.6.7.1

Port Scan

Field Name

Sample value

Explanation

1.

Enable

Enable/Disable

Enable port scan prevention

2.

Interval

30

Time interval in seconds counting how much port scan

(10

–

60 sec.)

3.

Scan count

10

How much port scan before blocked

79

7.6.7.2

Defending type

Field Name

Explanation

1.

SYN-FIN attack

Protect from SYN-FIN attack

2.

SYN-RST attack

Protect from SYN-RST attack

3.

X-Mas attack

Protect from X-Mas attack

4.

FIN scan

Protect from FIN scan

5.

NULLflags attack

Protect from NULLflags attack

7.7

Routing

7.7.1

Static Routes

Static routes specify over which interface and gateway a certain host or network can be reached.

80

Field name

Value

Explanation

1.

Routing table

MAIN/WAN/WAN2/WAN3

Defines the table to use for the route

2.

Interface

MAIN/WAN/WAN2/WAN3

The zone where the target network resides

3.

Destination address

IP address

The address of the destination network

4.

Netmask

IP mask

Mask that is applied to the Target to determine to what actual

IP addresses the routing rule applies

5.

Gateway

IP address

To where the router should send all the traffic that applies to

the rule

6.

Metric

integer

Used as a sorting measure. If a packet about to be routed fits

two rules, the one with the higher metric is applied.

Additional note on Target & Netmask: You can define a rule that applies to a single IP like this: Target - some IP;

Netmask - 255.255.255.255. Furthermore you can define a rule that applies to a segment of IPs like this: Target

–

some

IP that STARTS the segment; Netmask

–

Netmask that defines how large the segment is. E.g.:

192.168.55.161

255.255.255.255

Only applies to 192.168.55.161

192.168.55.0

255.255.255.0

Applies to IPs in range 192.168.55.0-192.168.55.255

192.168.55.240

255.255.255.240

Applies 192.168.55.240 -

192.168.55.255

192.168.55.161

255.255.255.0

192.168.55.0 - 192.168.55.255

192.168.0.0

255.255.0.0

192.168.0.0 - 192.168.255.255

7.7.2

Dynamic Routes

7.7.2.1

General

Dynamic routes provide dynamic routing which enables router to select paths according to real-time logical

network layout changes.

Field name

Value

Explanation

1.

Enable

Enable/Disable

Enable dynamic routes

2.

Router ID

192.168.1.1

Router’s ID