User manual SIGMA SPORT BC 1400

[. . . ] Neither does it convey any license under its patent rights nor the patent rights of others. ZyXEL further reserves the right to make changes in any products described herein without notice. This publication is subject to change without notice. Trademarks ZyNOS (ZyXEL Network Operating System) is a registered trademark of ZyXEL Communications, Inc. Other trademarks mentioned in this publication are used for identification purposes only and may be properties of their respective owners. Copyright 3 P-660HW-T v2 User's Guide Certifications Federal Communications Commission (FCC) Interference Statement The device complies with Part 15 of FCC rules. [. . . ] Firewalls, of one type or another, have become an integral part of standard security solutions for enterprises. 9. 3 Introduction to ZyXEL's Firewall The ZyXEL Device firewall is a stateful inspection firewall and is designed to protect against Denial of Service attacks when activated. The ZyXEL Device's purpose is to allow a private Local Area Network (LAN) to be securely connected to the Internet. The ZyXEL Device can be used to prevent theft, destruction and modification of data, as well as log events, which may be important to the security of your network. The ZyXEL Device also has packet filtering capabilities. The ZyXEL Device is installed between the LAN and the Internet. This allows it to act as a secure gateway for all data passing between the Internet and the LAN. The ZyXEL Device has one DSL/ISDN port and one Ethernet LAN port, which physically separate the network into two areas. · The DSL/ISDN port connects to the Internet. 138 Chapter 9 Firewalls P-660HW-T v2 User's Guide · The LAN (Local Area Network) port attaches to a network of computers, which needs security from the outside world. These computers will have access to Internet services such as e-mail, FTP, and the World Wide Web. However, "inbound access" will not be allowed unless you configure remote management or create a firewall rule to allow a remote host to use a specific service. 9. 3. 1 Denial of Service Attacks Figure 78 Firewall Application 9. 4 Denial of Service Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the Internet. Their goal is not to steal information, but to disable a device or network so users no longer have access to network resources. Each packet causes the targeted system to issue a SYN-ACK response. While the targeted system waits for the ACK that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a backlog queue. SYN-ACKs are moved off the queue only when an ACK comes back or when an internal timer (which is set at relatively long intervals) terminates the three-way handshake. Once the queue is full, the system will ignore all incoming SYN requests, making the system unavailable for legitimate users. Figure 80 SYN Flood · In a LAND Attack, hackers flood SYN packets into the network with a spoofed source IP address of the targeted system. This makes it appear as if the host computer sent the packets to itself, making the system unavailable while the target system tries to respond to itself. 7 A brute-force attack, such as a "Smurf" attack, targets a feature in the IP specification known as directed or subnet broadcasting, to quickly flood the target network with useless data. A Smurf hacker floods a router with Internet Control Message Protocol (ICMP) echo request packets (pings). Since the destination IP address of each packet is the broadcast address of the network, the router will broadcast the ICMP echo request packet to all hosts on the network. If there are numerous hosts, this will create a large amount of ICMP echo request and response traffic. If a hacker chooses to spoof the source IP address of the ICMP echo request packet, the resulting ICMP traffic will not only clog up the "intermediary" network, but will also congest the network of the spoofed source IP address, known as the "victim" network. This flood of broadcast traffic consumes all available bandwidth, making communications impossible. Chapter 9 Firewalls 141 P-660HW-T v2 User's Guide Figure 81 Smurf Attack 9. 4. 2. 1 ICMP Vulnerability ICMP is an error-reporting protocol that works in concert with IP. [. . . ] 2 Clear the Block pop-ups check box in the Pop-up Blocker section of the screen. This disables any web pop-up blockers you may have enabled. Appendix L Pop-up Windows, JavaScripts and Java Permissions 335 P-660HW-T v2 User's Guide Figure 189 Internet Options 3 Click Apply to save this setting. Enable pop-up Blockers with Exceptions Alternatively, if you only want to allow pop-up windows from your device, see the following steps. 1 In Internet Explorer, select Tools, Internet Options and then the Privacy tab. 2 Select Settings. . . to open the Pop-up Blocker Settings screen. 336 Appendix L Pop-up Windows, JavaScripts and Java Permissions P-660HW-T v2 User's Guide Figure 190 Internet Options (2) 3 Type the IP address of your device (the web page that you do not want to have blocked) with the prefix "http://". [. . . ]