User manual ZYXEL PRESTIGE 2302RL

[. . . ] P-2302R Series VoIP Station Gateway User's Guide Version 3. 60 06/2005 P-2302R Series User's Guide Copyright Copyright © 2005 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved. Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. [. . . ] The Prestige can be used to prevent theft, destruction and modification of data, as well as log events, which may be important to the security of your network. The Prestige is installed between the LAN and a broadband modem connecting to the Internet. This allows it to act as a secure gateway for all data passing between the Internet and the LAN. Chapter 14 Firewall 149 P-2302R Series User's Guide The Prestige has one Ethernet WAN port and four Ethernet LAN ports, which are used to physically separate the network into two areas. The WAN (Wide Area Network) port attaches to the broadband (cable or DSL) modem to the Internet. The LAN (Local Area Network) port attaches to a network of computers, which needs security from the outside world. These computers will have access to Internet services such as e-mail, FTP and the World Wide Web. However, "inbound access" is not allowed (by default) unless the remote host is authorized to use a specific service. 14. 1. 3 Guidelines For Enhancing Security With Your Firewall 1 Change the default password via web configurator. 2 Think about access control before you connect to the network in any way, including attaching a modem to the port. 4 Don't enable any local service (such as SNMP or NTP) that you don't use. Any enabled service could present a potential security risk. A determined hacker might be able to find creative ways to misuse the enabled services to access the firewall or the network. 5 For local services that are enabled, protect against misuse. Protect by configuring the services to communicate only with specific peers, and protect by configuring rules to block packets for the services at specific interfaces. 6 Protect against IP spoofing by making sure the firewall is active. 7 Keep the firewall in a secured (locked) room. 14. 2 Firewall Settings Screen In the navigation panel, click FIREWALL to open the Settings screen. 150 Chapter 14 Firewall P-2302R Series User's Guide Figure 60 Firewall: Settings The following table describes the labels in this screen. Table 42 Firewall: Settings LABEL Enable Firewall Bypass Triangle Route DESCRIPTION Select this check box to activate the firewall. The Prestige performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated. Select this check box to have the Prestige firewall permit the use of triangle route topology on the network. Note: Allowing triangle routes may let traffic from the WAN go directly to a LAN computer without passing through the Prestige. See the appendices for more on triangle route topology and how to deal with this problem. LAN to WAN Packets to Log To log packets related to firewall rules, make sure that Access Control under Log is selected in the Logs, Log Settings screen. Choose from: No Log Log Blocked (blocked LAN to WAN services appear in the Blocked Services text box in the Services screen (with Enable Services Blocking selected)) Log All (log all LAN to WAN packets) Chapter 14 Firewall 151 P-2302R Series User's Guide Table 42 Firewall: Settings LABEL WAN to LAN Packets to Log DESCRIPTION To log packets related to firewall rules, make sure that Access Control under Log is selected in the Logs, Log Settings screen. Choose what WAN to LAN and WAN to WAN/Prestige packets to log. Choose from: No Log Log Forwarded (see how to forward WAN to LAN traffic in the next section) Log All (log all WAN to LAN packets). You can allow a specific computer to access all Internet resources without restriction. Enter the IP address of the trusted computer in this field. [. . . ] Some companies have more than one alternate route to one or more ISPs. If the LAN and ISP(s) are in the same subnet, the "triangle route" problem may occur. The steps below describe the "triangle route" problem. 1 A computer on the LAN initiates a connection by sending out a SYN packet to a receiving server on the WAN. [. . . ]