Home » ZyXEL Manuals » Networking » ZyXEL P-660HW-67 » Manual Viewer

ZyXEL P-660HW-67 User Guide - Page 178

Security Considerations, Triangle Route

Get ZyXEL P-660HW-67 PDF manuals and user guides

Add to My Manuals
Save this manual to your list of manuals

Page 178 highlights

Chapter 10 Firewall 12 Keep the firewall in a secured (locked) room. 10.7.3 Security Considerations Note: Incorrectly configuring the firewall may block valid access or introduce security risks to the ZyXEL Device and your protected network. Use caution when creating or deleting firewall rules and test your rules after you configure them. Consider these security ramifications before creating a rule: 1 Does this rule stop LAN users from accessing critical resources on the Internet? For example, if IRC is blocked, are there users that require this service? 2 Is it possible to modify the rule to be more specific? For example, if IRC is blocked for all users, will a rule that blocks just certain users be more effective? 3 Does a rule that allows Internet users access to resources on the LAN create a security vulnerability? For example, if FTP ports (TCP 20, 21) are allowed from the Internet to the LAN, Internet users may be able to connect to computers with running FTP servers. 4 Does this rule conflict with any existing rules? Once these questions have been answered, adding rules is simply a matter of entering the information into the correct fields in the web configurator screens. 10.7.4 Triangle Route When the firewall is on, your ZyXEL Device acts as a secure gateway between your LAN and the Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the ZyXEL Device to protect your LAN against attacks. Figure 81 Ideal Firewall Setup LAN 1 WAN 2 10.7.4.1 The "Triangle Route" Problem A traffic route is a path for sending or receiving data packets between two Ethernet devices. You may have more than one connection to the Internet (through one or more ISPs). If an alternate gateway is on the LAN (and its IP address is in the same subnet as the ZyXEL Device's LAN IP address), the "triangle route" (also called asymmetrical route) problem may occur. The steps below describe the "triangle route" problem. 1 A computer on the LAN initiates a connection by sending out a SYN packet to a receiving server on the WAN. 178 ADSL Router Series User's Guide

Section	Page
ADSL Router Series	1
About This User's Guide	3
Document Conventions	5
Safety Warnings	7
Contents Overview	9
Table of Contents	11
User’s Guide	21
Introduction	23
1.1 Overview	23
1.2 Ways to Manage the ZyXEL Device	23
1.3 Good Habits for Managing the ZyXEL Device	24
1.4 Applications for the ZyXEL Device	24
1.4.1 Internet Access	24
1.5 Wireless Access	25
1.5.1 Using the WPS/WLAN Button	25
1.6 The RESET Button	26
1.6.1 Using the Reset Button	27
The Web Configurator	29
2.1 Overview	29
2.1.1 Accessing the Web Configurator	29
2.2 The Main Screen	31
2.2.1 Title Bar	31
2.2.2 Navigation Panel	32
2.2.3 Main Window	34
2.2.4 Status Bar	34
Status Screens	35
3.1 Overview	35
3.2 The Status Screen	36
Tutorials	41
4.1 Overview	41
4.2 Setting Up Your DSL Connection	41
4.3 IPv6 Address Configuration	43
4.3.1 6to4 Tunneling	44
4.4 Setting Up a Secure Wireless Network	45
4.4.1 Configuring the Wireless Network Settings	45
4.4.2 Using WPS	46
4.4.3 Connecting Wirelessly to your ZyXEL Device	50
4.5 Configuring the MAC Address Filter for Restricting Wireless Internet Access	52
4.6 Multiple Public and Private IP Address Mappings	54
4.6.1 Full Feature NAT + Many-to-Many No Overload Mapping	55
4.6.2 Full Feature NAT + One-to-One Mapping	57
4.7 Setting Up NAT Forwarding for a Game Server	58
4.7.1 Port Forwarding	58
4.8 Configuring Firewall Rules to Allow a Specified Service	60
4.9 Configuring Static Route for Routing to Another Network	63
4.10 Port Binding Configuration	65
4.10.1 Configuring ATM QoS for Multiple WAN Connections	65
4.10.2 Configuring Port Binding	67
4.11 Configuring QoS to Prioritize Traffic	68
4.12 Access the ZyXEL Device from the Internet Using DDNS	71
4.12.1 Registering a DDNS Account on www.dyndns.org	71
4.12.2 Configuring DDNS on Your ZyXEL Device	71
4.12.3 Testing the DDNS Setting	72
4.13 How to Use File Sharing on the ZyXEL Device	72
4.13.1 Set up file sharing	72
4.13.2 Access Your Shared Files From a Computer	73
4.14 How to Share a USB Printer via Your ZyXEL Device	74
Technical Reference	77
Internet and Wireless Setup Wizard	79
5.1 Overview	79
5.2 Internet Access Wizard Setup	79
5.2.1 Manual Configuration	82
5.3 Wireless Connection Wizard Setup	87
5.3.1 Manually Assign a WPA-PSK key	90
5.3.2 Manually Assign a WEP Key	90
WAN Setup	93
6.1 Overview	93
6.1.1 What You Can Do in the WAN Screens	93
6.1.2 What You Need to Know About WAN	93
6.1.3 Before You Begin	94
6.2 The Internet Access Setup Screen	95
6.2.1 Advanced Internet Access Setup	98
6.3 The More Connections Screen	100
6.3.1 More Connections Edit	101
6.3.2 Configuring More Connections Advanced Setup	103
6.4 WAN Technical Reference	104
6.4.1 Encapsulation	104
6.4.2 Multiplexing	105
6.4.3 VPI and VCI	106
6.4.4 IP Address Assignment	106
6.4.5 Nailed-Up Connection (PPP)	106
6.4.6 NAT	107
6.5 Traffic Shaping	107
6.5.1 ATM Traffic Classes	108
LAN Setup	109
7.1 Overview	109
7.1.1 What You Can Do in the LAN Screens	109
7.1.2 What You Need To Know About LAN	109
7.1.3 Before You Begin	110
7.2 The LAN IP Screen	110
7.2.1 The Advanced LAN IP Setup Screen	111
7.3 The DHCP Setup Screen	112
7.4 The Client List Screen	113
7.5 The IP Alias Screen	114
7.5.1 Configuring the LAN IP Alias Screen	115
7.6 The IPv6 Screen	116
7.7 LAN Technical Reference	119
7.7.1 LANs, WANs and the ZyXEL Device	119
7.7.2 DHCP Setup	119
7.7.3 DNS Server Addresses	119
7.7.4 LAN TCP/IP	120
7.7.5 RIP Setup	121
7.7.6 Multicast	121
Wireless LAN	123
8.1 Overview	123
8.1.1 What You Can Do in the Wireless LAN Screens	123
8.1.2 What You Need to Know About Wireless	123
8.1.3 Before You Start	124
8.2 The AP Screen	125
8.2.1 No Security	126
8.2.2 WEP Encryption	127
8.2.3 WPA(2)-PSK	128
8.2.4 Wireless LAN Advanced Setup	128
8.2.5 MAC Filter	130
8.3 The More AP Screen	131
8.3.1 More AP Edit	132
8.4 The WPS Screen	133
8.5 The WPS Station Screen	134
8.6 The WDS Screen	135
8.7 The Scheduling Screen	136
8.8 Wireless LAN Technical Reference	137
8.8.1 Wireless Network Overview	137
8.8.2 Additional Wireless Terms	139
8.8.3 Wireless Security Overview	139
8.8.4 Signal Problems	141
8.8.5 BSS	142
8.8.6 MBSSID	142
8.8.7 Wireless Distribution System (WDS)	143
8.8.8 WiFi Protected Setup (WPS)	143
Network Address Translation (NAT)	151
9.1 Overview	151
9.1.1 What You Can Do in the NAT Screens	151
9.1.2 What You Need To Know About NAT	151
9.2 The NAT General Setup Screen	152
9.3 The Port Forwarding Screen	153
9.3.1 Configuring the Port Forwarding Screen	154
9.3.2 The Port Forwarding Rule Edit Screen	155
9.4 The Address Mapping Screen	156
9.4.1 The Address Mapping Rule Edit Screen	157
9.5 The ALG Screen	158
9.6 NAT Technical Reference	159
9.6.1 NAT Definitions	159
9.6.2 What NAT Does	160
9.6.3 How NAT Works	160
9.6.4 NAT Application	161
9.6.5 NAT Mapping Types	161
Firewall	163
10.1 Overview	163
10.1.1 What You Can Do in the Firewall Screens	163
10.1.2 What You Need to Know About Firewall	164
10.2 The Firewall Screen	166
10.3 The Firewall General Screen	167
10.4 The Default Action Screen	168
10.5 The Rules Screen	169
10.5.1 The Rules Add Screen	170
10.5.2 Customized Services	172
10.5.3 Configuring a Customized Service	172
10.6 The DoS Screen	174
10.6.1 The DoS Advanced Screen	174
10.6.2 Configuring Firewall Thresholds	175
10.7 Firewall Technical Reference	176
10.7.1 Firewall Rules Overview	176
10.7.2 Guidelines For Enhancing Security With Your Firewall	177
10.7.3 Security Considerations	178
10.7.4 Triangle Route	178
Filters	181
11.1 Overview	181
11.1.1 What You Can Do in the Filter Screens	181
11.1.2 What You Need to Know About Filtering	181
11.2 The URL Filter Screen	182
11.3 The Application Filter Screen	183
11.4 The IP/MAC Filter Screen	184
11.5 IPv6/MAC Filter	186
Certificate	189
12.1 Overview	189
12.1.1 What You Can Do in this Chapter	189
12.2 What You Need to Know	189
12.3 The Trusted CA Screen	189
12.3.1 View Trusted CA Certificate	191
12.3.2 Import Trusted CA Certificate	192
Static Route	193
13.1 Overview	193
13.1.1 What You Can Do in the Static Route Screens	194
13.2 The Static Route Screen	194
13.2.1 Static Route Edit	195
13.2.2 IPv6 Static Route	196
13.2.3 IPv6 Static Route Edit	197
Port Binding	199
14.1 Overview	199
14.1.1 What You Can Do in the Port Binding Screens	200
14.2 The Port Binding Screen	200
14.2.1 Port Binding Summary Screen	201
802.1Q/1P	203
15.1 Overview	203
15.1.1 What You Can Do in the 802.1Q/1P Screens	203
15.1.2 What You Need to Know About 802.1Q/1P	203
15.2 The 802.1Q/1P Group Setting Screen	204
15.2.1 Editing 802.1Q/1P Group Setting	206
15.3 The 802.1Q/1P Port Setting Screen	207
Quality of Service (QoS)	209
16.1 Overview	209
16.1.1 What You Can Do in the QoS Screens	209
16.1.2 What You Need to Know About QoS	210
16.2 The General Screen	210
16.2.1 The QoS Summary List Screen	211
16.3 The Queue Setup Screen	212
16.4 The Class Setup Screen	213
16.5 QoS Technical Reference	215
16.5.1 IEEE 802.1p	215
16.5.2 IP Precedence	215
16.5.3 Automatic Priority Queue Assignment	216
Dynamic DNS Setup	217
17.1 Overview	217
17.1.1 What You Can Do in the DDNS Screen	217
17.1.2 What You Need To Know About DDNS	217
17.2 The Dynamic DNS Screen	218
Remote Management	219
18.1 Overview	219
18.1.1 What You Can Do in the Remote Management Screens	219
18.1.2 What You Need to Know About Remote Management	220
18.2 The WWW Screen	220
18.2.1 Configuring the WWW Screen	221
18.3 The Telnet Screen	221
18.4 The FTP Screen	222
18.5 The SNMP Screen	223
18.5.1 Configuring SNMP	225
18.6 The DNS Screen	225
18.7 The ICMP Screen	226
18.8 The SSH Screen	227
18.8.1 SSH Example	228
Universal Plug-and-Play (UPnP)	230
19.1 Overview	230
19.1.1 What You Can Do in the UPnP Screen	230
19.1.2 What You Need to Know About UPnP	230
19.2 The UPnP Screen	231
19.3 Installing UPnP in Windows Example	232
19.4 Using UPnP in Windows XP Example	235
File Sharing	241
20.1 Overview	241
20.1.1 What You Can Do in this chapter	241
20.1.2 What You Need to Know	241
20.1.3 Before You Begin	242
20.2 The File Sharing Screen	243
20.2.1 User Edit	244
Sharing a USB Printer	245
21.1 Overview	245
21.1.1 What You Can Do in this chapter	245
21.2 What You Need to Know	245
21.3 Before You Begin	246
21.4 The Print Server Screen	246
21.5 Add a New Printer Using Windows	247
21.6 Add a New Printer Using Macintosh OS X	251
21.6.1 Mac OS 10.3 and 10.4	251
21.6.2 Mac OS 10.5 and 10.6	254
CWMP	259
22.1 Overview	259
22.2 The CWMP Setup Screen	260
System Settings	263
23.1 Overview	263
23.1.1 What You Can Do in the System Settings Screens	263
23.2 The General Screen	263
23.3 The Time Setting Screen	264
Logs	267
24.1 Overview	267
24.1.1 What You Need To Know About Logs	267
24.2 The View Log Screen	267
24.3 The Log Settings Screen	268
Tools	271
25.1 Overview	271
25.1.1 What You Can Do in the Tool Screens	271
25.2 The Firmware Screen	271
25.3 The Configuration Screen	273
25.4 The Restart Screen	275
Diagnostic	277
26.1 Overview	277
26.1.1 What You Can Do in the Diagnostic Screens	277
26.2 The General Screen	277
26.3 The DSL Line Screen	278
Troubleshooting	281
27.1 Power, Hardware Connections, and LEDs	281
27.2 ZyXEL Device Access and Login	282
27.3 Internet Access	283
Product Specifications	285
28.1 Hardware Specifications	285
Setting up Your Computer’s IP Address	287
IP Addresses and Subnetting	309
Pop-up Windows, JavaScripts and Java Permissions	317
Wireless LANs	327
IPv6	341
Services	351
Legal Information	355

Match case Limit results 1 per page

Chapter 10 Firewall

ADSL Router Series User’s Guide

178

Keep the firewall in a secured (locked) room.

10.7.3

Security Considerations

Note: Incorrectly configuring the firewall may block valid access or introduce security

risks to the ZyXEL Device and your protected network. Use caution when creating

or deleting firewall rules and test your rules after you configure them.

Consider these security ramifications before creating a rule:

Does this rule stop LAN users from accessing critical resources on the Internet? For example, if IRC

is blocked, are there users that require this service?

Is it possible to modify the rule to be more specific? For example, if IRC is blocked for all users, will

a rule that blocks just certain users be more effective?

Does a rule that allows Internet users access to resources on the LAN create a security

vulnerability? For example, if FTP ports (TCP 20, 21) are allowed from the Internet to the LAN,

Internet users may be able to connect to computers with running FTP servers.

Does this rule conflict with any existing rules?

Once these questions have been answered, adding rules is simply a matter of entering the

information into the correct fields in the web configurator screens.

10.7.4

Triangle Route

When the firewall is on, your ZyXEL Device acts as a secure gateway between your LAN and the

Internet. In an ideal network topology, all incoming and outgoing network traffic passes through

the ZyXEL Device to protect your LAN against attacks.

Figure 81

Ideal Firewall Setup

10.7.4.1

The “Triangle Route” Problem

A traffic route is a path for sending or receiving data packets between two Ethernet devices. You

may have more than one connection to the Internet (through one or more ISPs). If an alternate

gateway is on the LAN (and its IP address is in the same subnet as the ZyXEL Device’s LAN IP

address), the “triangle route” (also called asymmetrical route) problem may occur. The steps below

describe the “triangle route” problem.

A computer on the LAN initiates a connection by sending out a SYN packet to a receiving server on

the WAN.

WAN

LAN