Security |
 |
|
Add DMZ WAN Service |
Outbound Service |
This page is used for setting up a firewall rule for traffic going from the DMZ
network to the WAN. Outbound traffic for a service can be configured to be
blocked or allowed at all times, or per a schedule (defined in the
Schedule page
on the
Security menu).
To add an outbound rule, input the following fields: |
Service Name: This is a unique name assigned to the
service. The name usually indicates the type of traffic the rule covers such as
ftp, ssh, telnet, ping, etc. Services not already in the list can be added on
the
Services page under the
Security menu Services page. |
Filter: Defines an action to be taken on the
enabled rule. It can be: |
v |
Block Always: Block selected service at all times. |
v |
Enable Always: Allow selected service to pass
through at all times. |
v |
Block by schedule, otherwise allow: Works in
conjunction with a schedule defined in the
Schedule 1/2/3 pages. The selected
service will be blocked during the scheduled interval and will be allowed to
pass through at other times. |
v |
Allow by schedule, otherwise block: Works in
conjunction with a schedule defined in the
Schedule 1/2/3 pages. The selected
service will be allowed to pass through during the scheduled interval and will
be blocked at other times. |
|
DMZ Users: Specifies whether one or more IP
Addresses on the DMZ network will be affected by the rule. This rule will affect
packets for the selected service from the defined IP address or range of IP
addresses on the DMZ network. |
v |
Any: All computers on the DMZ network will be
affected by the rule. |
v |
Single Address: A single IP address on the DMZ
network will be affected by the rule. |
v |
Address Range: A range of IP addresses on the DMZ
network will be affected by the rule. |
|
WAN Users: Specifies whether one or more IP
addresses on the WAN will be affected by the rule. This rule will affect packets
for the selected service to the defined IP address or range of IP addresses on
the WAN side. |
v |
Any: All IP addresses on the WAN will be affected
by the rule. |
v |
Single Address: A single WAN IP address will be
affected by the rule. |
v |
Address Range: A range of WAN IP addresses will be
affected by the rule. |
|
Priority: The priority assigned to IP packets of
this service. The priorities are defined by “Type of Service (TOS) in the
Internet Protocol Suite” standards, RFC 1349. The router marks the Type Of
Service (TOS) field as defined below: |
v |
Normal-Service: No special priority given to the
traffic. The IP packets for services with this priority are marked with a TOS
value of 0x00. |
v |
Minimize-Cost: Used when data must be transferred
over a link that has a lower "cost". The IP packets for services with this
priority are marked with a TOS value of 0x02.
|
v |
Maximize-Reliability: Used when data needs to
travel to the destination over a reliable link and with little or no
retransmission. The IP packets for services with this priority are marked with a
TOS value of 0x04.
|
v |
Maximize-Throughput: Used when the volume of data
transferred during an interval is important even if the latency over the link is
high. The IP packets for services with this priority are marked with a TOS value
of 0x08. |
v |
Minimize-Delay: Used when the time required
(latency) for the packet to reach the destination must be low. The IP packets
for services with this priority are marked with a TOS value of 0x10. |
|
Log: Specifies whether the packets for this rule
should be logged or not. To log details for all packets that match this rule,
select
Always. Select
Never to disable logging.
For example, if an outbound rule for a schedule is selected as
Block Always, then for every packet that tries to
make an outbound connection for that service, a message with the packet’s source
address and destination address (and other information) will be recorded in the
log. Enabling logging may generate a significant volume of log messages and is
recommended for debugging purposes only. |
NAT IP: Specifies
whether the source address of the outgoing packets on WAN should be
assigned WAN interface address OR different one. |
NAT single IP is on: The
Interface to which the NAT IP belongs to. All the outgoing packets on WAN will
be routed through the specified WAN interface only. |
v |
WAN Interface Address:
All the outgoing packets on WAN will be assigned WAN interface address. |
v |
Single Address: All the outgoing packets on WAN
will be assigned the specified IP address. |
|
Note:
This option will be available only when WAN mode is "NAT". The IP
address specified should fall under the WAN subnet. |
Click Apply
to save the settings. |
Click Reset
to revert to the previous settings. |
Add DMZ WAN Service |
Inbound Service |
This page is used for setting up a firewall rule for traffic coming from the WAN
to the DMZ network. Inbound traffic for a service can be configured to be
blocked or allowed, by default, or per a schedule (defined on the
Schedule menu.
Security page).
To add an inbound rule, complete the following fields: |
Service
Name: This is a unique name assigned to the
service. The name usually indicates the type of traffic the rule covers such as
ftp, ssh, telnet, ping, etc. Services not already in the list can be added on
Services page under the Security menu. |
Filter: Defines an action to be taken on the
enabled rule. It can be: |
v |
Block
Always: Block selected service at all times. |
v |
Enable
Always: Allow selected service to pass through at
all times. |
v |
Block by schedule, otherwise allow: Works in
conjunction with a schedule defined in the
Schedule 1/2/3 pages. Selected service will be
blocked during the scheduled interval and will be allowed to pass through at
other times. |
v |
Allow by schedule, otherwise block: Works in
conjunction with a schedule defined in the
Schedule 1/2/3 pages. Selected service will be
allowed to pass through during the scheduled interval and will be blocked at
other times. |
|
Send to DMZ IP Address: An IP address and port
number of a machine on the DMZ network which is hosting the server. Select the
port number checkbox only if the server is listening on a port other than the
default port. For example, if a machine on the DMZ side is running a telnet
server on port 2000, then select the Translate to Port
Number checkbox and type 2000 in the
Port field; if it is listening on default port 23,
then the box can be left unchecked.
Note: This option is only available when the router
is in NAT mode (see the
Network Configuration menu,
WAN Mode page). |
Destination: The WAN IP address that will map to
the incoming server. It can either be the address of the WAN1 or WAN2 ports or
another WAN IP address. This field is only enabled under NAT mode because the
router needs to map traffic coming from a particular WAN port to a DMZ machine. |
DMZ Users: Specifies whether one or more IP
addresses on the DMZ network will be affected by the rule. This field is only
enabled in routing mode since the DMZ network is accessible only in this mode. |
v |
Any: All computers on the DMZ network will be
affected by the rule. |
v |
Single Address: A single IP address on the DMZ
network will be affected by the rule. |
v |
Address
Range: AA range of IP addresses on the DMZ network
will be affected by the rule. |
|
WAN
Users: Specifies whether one or more IP addresses
on the WAN will be affected by the rule. This rule will affect packets that are
transferred for the selected service to the IP address or range of IP addresses
on the WAN side. |
v |
Any: All IP addresses on the WAN will be affected
by the rule. |
v |
Single
Address: A single WAN IP address will be affected
by the rule. |
v |
Address
Range: A range of WAN IP addresses will be affected
by the rule. |
|
Log: Specifies whether the packets for this rule
should be logged or not. To log details for all packets that match this rule,
select
Always. Select
Never to disable logging. |
For example, if an inbound rule for a schedule is selected as
Block Always, then for every packet that tries to
make an outbound connection for that service, a message with the packet’s source
and destination addresses (and other information) will be recorded in the log.
Enabling logging may generate a significant volume of log messages and is
recommended for debugging purposes only. |
Click
Apply to save the settings. |
Click
Reset to revert to the previous settings. |
|