Security close
Attack Checks
This page allows you to specify if the router should be protected against common attacks from the LAN, DMZ and WAN networks.
The various types of attack checks are defined below. Select the appropriate checkboxes to enable the required security measures.
WAN Security Checks:
v Respond to Ping On WAN Ports: To configure the router to respond to an ICMP Echo (ping) packet coming from the WAN side, select this radio box. This setting is usually used as a diagnostic tool for connectivity problems. It is recommended that the option be disabled at other times to prevent hackers from easily discovering the router via a ping.
To allow any remote host to be able to ping to wan port please select choice "Any". This is the default case.
To Allow only a specific IP to be able to ping to wan port please select choice "IP Address".Also, Please specify the IP address.
Note: Under NAT mode (Network Configuration menu, WAN Mode page), a firewall rule to direct ping requests to a particular computer on the LAN or DMZ will override this option.
v Enable Stealth Mode: If Stealth Mode is enabled, the router will not respond to port scans from the WAN, thus making it less susceptible to discovery and attacks.
v Block TCP Flood: If this option is enabled, the router will drop all invalid TCP packets and protect from a SYN flood attack.
v TCP Flood Limit:: Configure this value in the range of 1-100 packets per second. The router drops the tcp packets over this limit.
LAN Security Checks:
v Block UDP Flood: If this option is enabled, the router will not accept more than 20 simultaneous, active UDP connections from a single computer on the LAN.
v UDP Flood Limit: Configure this value in the range of 1-40 connections per second. The router drops the udp packets over this limit.
v Disable Ping Reply on LAN Ports: This option configures the router to stop responding to an ICMP echo (ping) packets coming from the LAN side. This setting is usually used as a diagnostic tool for connectivity problems. By default this must be disabled.
VPN Pass through:
v IPSec/PPTP/L2TP: Typically, the router is used as a VPN Client or Gateway that connects to other VPN gateways. When the router is in NAT mode, all packets going to the Remote VPN Gateway are first filtered through NAT and then encrypted per the VPN policy.
In situations where a VPN Client or Gateway on the LAN side of this router wants to connect to another VPN endpoint on the WAN (putting this router inbetween two VPN end points), encrypted packets are sent to this router. Since this router filters the encrypted packets through NAT, the packets become invalid.
IPSec, PPTP and L2TP represent different types of VPN tunnels that can pass packets through this router. To allow the VPN traffic to pass through without filtering, enable the option by checking the appropriate radio box for the type of tunnel that will pass through this router.
Multicast Pass through:
v IGMP: IGMP is a communcations protocol used to manage IP multicast groups.
Checking this option results in IGMP Proxy being enabled for WAN(upstream) and LAN(downstream) interfaces. With this, the router will keep track of IGMP group membership reports from LAN hosts joining and leaving the group. The relevant multicast traffic is then forwarded from WAN to LAN.
 

2013 © Copyright NETGEAR®

close