ZyXEL Communications Broadband Security Gateway P-312 - Manual (Page 156)

P312 Broadband Security Gateway
13-8 What Is a Firewall?
7. The packet is inspected by a firewall rule, and the connection's state table entry is updated as
necessary. Based on the updated state information, the inbound extended access list temporary
entries might be modified, in order to permit only packets that are valid for the current state of the
connection.
8. Any additional inbound or outbound packets that belong to the connection are inspected to update
the state table entry and to modify the temporary inbound access list entries as required, and are
forwarded through the interface.
9. When the connection terminates or times out, the connection's state table entry is deleted, and the
connection's temporary inbound access list entries are deleted.
13.4.2 Stateful Inspection & the Prestige
Additional rules may be defined to extend or override the default rules. For example, a rule may be created
which will:
i. Block all traffic of a certain type, such as IRC (Internet Chat), from the LAN to the Internet.
ii. Allow certain types of traffic from the Internet to specific hosts on the LAN.
iii. Allow access to a Web server to everyone but competitors.
iv. Restrict use of certain protocols, such as Telnet, to authorized users on the LAN.
These custom rules work by evaluating the network traffic’s Source IP address, Destination IP address, IP
protocol type, and comparing these to rules set by the administrator.
Note: The ability to define Prestige Web Configurator Firewall Rules is a very powerful
tool. Using custom rules, it is possible to disable all firewall protection or block all
access to the Internet. Use extreme caution when creating or deleting Firewall Rules.
Test changes after creating them to make sure they work correctly.
Below is a brief technical description of how these connections are tracked. Connections may either be
defined by the upper protocols (for instance, TCP), or by the Prestige itself (as with the "virtual connections"
created for UDP and ICMP).
13.4.3 TCP Security
The Prestige uses the state information embedded in TCP packets. The first packet of any new connection
has its SYN flag set and its ACK flag cleared; these are "initiation" packets. All packets that do not have this
flag structure are called "subsequent" packets, since they represent data that occurs later in the TCP stream.
If an initiation packet originates on the WAN, this means that someone is trying to make a connection from
the Internet into the LAN. Except in a few special cases (see "Upper Layer Protocols" below), these packets
are dropped and logged.
If an initiation packet originates on the LAN, this means that someone is trying to make a connection from
the LAN to the Internet. Assuming that this is an acceptable part of the security policy (as is the case with the
default policy), the connection will be allowed through. A cache entry is added which includes connection
information such as IP addresses, TCP ports, sequence numbers, etc.