Figure 41-1 IP Filter Rules

Transcription

1 41. Firewall / IP Filter This function allows user to enable the functionality of IP filter. Both inside and outside packets through router could be decided to allow or drop by supervisor. Figure 41-1 IP Filter Rules 41.1 Examples and Web Configurations Example 1 : Employees ( ~ ) are interdicted to surf Internet. Other employees ( ~31) are permitted. 1. Enable the Data Filter Function. Figure 41-2 Vigor3300 Series Application Note V

2 Figure Add new rules in Pass Group. Figure Add a rule about SMTP protocol. (port 25) for ~ Figure Vigor3300 Series Application Note V2.2

3 4. Add another rule about port 53 ( DNS protocol ), port 80 ( Http protocol ), port 110 ( POP3 protocol ) for ~ Finally, Add a rule in block group. Figure 41-6 Figure Beside the previous rules, other connections are forbidden. Figure 41-8 Vigor3300 Series Application Note V

4 Example 2 Only IP is allowed to access my VNC server from Internet as well as only IP is allowed to access my FTP server from Internet. (Other Internet hosts cannot access my internal servers). 1. Enable the Data Filter Function. Figure Add new rules in Pass Group. Figure Figure Vigor3300 Series Application Note V2.2

5 3. Allow IP to access my VNC server. (TCP port 5900) Figure Allow IP to access my FTP server. (TCP port 21) Figure Vigor3300 Series Application Note V

6 5. Finally, Add a rule in block group. Figure Besides the previous rules, other incoming connections are forbidden. Figure Vigor3300 Series Application Note V2.2

7 Example 3 Some employees (IP /27) can use FTP Mail Web service, and some (IP /26) can only use Mail service. 1. Enable the Data Filter Function. Figure Add new rules in Pass Group. Figure Figure Vigor3300 Series Application Note V

8 3. Allow users with IP ~ to use Mail service (SMTP protocol) Figure Allow users with IP ~ to use Mail service(pop3 protocol) Figure Vigor3300 Series Application Note V2.2

9 5. Allow users with IP ~ to use DNS service. Figure Allow users with IP ~ to use FTP, SMTP, POP3, WEB and DNS Services. Figure Vigor3300 Series Application Note V

10 Figure Add a rule in block group. Figure Beside the previous rules, other connections are forbidden. Figure Vigor3300 Series Application Note V2.2

11 Example 4 Host with IP cannot be accessed by the remote VPN network while hosts with IP and can be accessed. 1. Enable the Data Filter Function. Figure Add new rules in Pass Group. Figure Figure Vigor3300 Series Application Note V

12 3. Allow VPN connection from to and Figure Figure Vigor3300 Series Application Note V2.2

13 4. Add a rule in block group. Figure Disallow VPN connection from to Figure Vigor3300 Series Application Note V

14 Example 5 Some users ( ~ ) can surf Internet and some ( ~ ) can only access the remote VPN network. 1. Enable the Data Filter Function. Figure Add new rules in Pass Group. Figure Figure Vigor3300 Series Application Note V2.2

15 3. Allow local network to access remote VPN network Figure Figure Vigor3300 Series Application Note V

16 4. Allow users with IP ~ to surf Internet ( DNS protocol ) Figure Allow users with IP ~ to surf Internet ( HTTP protocol ) Figure Vigor3300 Series Application Note V2.2

17 6. Add a rule in block group. Figure Beside the previous rules, Other connections are forbidden. Figure Vigor3300 Series Application Note V

18 41.2 Firewall direction Figure Table 42-1 Firewall /IP Filter Direction. WAN to LAN WAN to DMZ WAN to WAN LAN to WAN LAN to DMZ LAN to LAN DMZ to WAN DMZ to LAN VPN In VPN Out Any From Internet to Intranet, ex : VNC Pc Anywhere remote control From Internet to DMZ, ex : allow Internet user to browser web server in DMZ From WAN to WAN, ex: Allow WAN1 traffic redirect to WAN2 From Intranet to Internet, ex : surf Internet From Intranet to DMZ, ex: allow some employees can access DMZ. From some security issue, we can use LAN to LAN block function to prohibited LAN1 user from visiting LAN2 resource in VLAN environment. From DMZ to WAN, ex:allow DMZ using Internet resources. Form DMZ to LAN, ex: allow DMZ using inner Database. From remote VPN network to Vigor 3300 s VPN network, pass/block From Vigor3300's VPN network to remote VPN network, pass/block All direction in/out, including LAN,WAN,DMZ,VPN 272 Vigor3300 Series Application Note V2.2