Netgear SRX5308 SRX5308 Reference Manual - Page 16

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual A Powerful, True Firewall with Content Filtering Unlike simple NAT routers, the SRX5308 is a true firewall, using stateful packet inspection (SPI) to defend against hacker attacks. Its firewall features have the following capabilities: • DoS protection. Automatically detects and thwarts denial of service (DoS) attacks such as Ping of Death and SYN flood. • Secure firewall. Blocks unwanted traffic from the Internet to your LAN. • Content filtering. Prevents objectionable content from reaching your PCs. You can control access to Internet content by screening for Web services, Web addresses, and keywords within Web addresses. You can configure the SRX5308 to log and report attempts to access objectionable Internet sites. • Schedule policies. Permits scheduling of firewall policies by day and time. • Logs security incidents. Logs security events such as blocked incoming traffic, port scans, attacks, and administrator logins. You can configure the SRX5308 to email the log to you at specified intervals. You can also configure the SRX5308 to send immediate alert messages to your email address or email pager when a significant event occurs. Security Features The SRX5308 is equipped with several features designed to maintain security: • PCs hidden by NAT. NAT opens a temporary path to the Internet for requests originating from the local network. Requests originating from outside the LAN are discarded, preventing users outside the LAN from finding and directly accessing the computers on the LAN. • Port forwarding with NAT. Although NAT prevents Internet locations from directly accessing the PCs on the LAN, the SRX5308 allows you to direct incoming traffic to specific PCs based on the service port number of the incoming request. You can specify forwarding of single ports or ranges of ports. • DMZ port. Incoming traffic from the Internet is normally discarded by the SRX5308 unless the traffic is a response to one of your local computers or a service for which you have configured an inbound rule. Instead of discarding this traffic, you can use the dedicated demilitarized zone (DMZ) port to forward the traffic to one PC on your network. 1-4 Introduction v1.0, April 20104