Filter
Top Products
6-36 CHAPTER 6: MANUAL SETUP
For more details, refer to the next two sections. Assigning Filters discusses how
to decide where to apply a filter, and Applying Filters explains the appropriate
CLI commands to use.
Assigning Filters Once a filter has been added to router’s list of managed filters, you can assign it to
the unit’s:
Interfaces
VC / Remote Site Profile
Interface Filters You can configure interface filters for any interface. Interface filters control access
to all networks available for both modem and non-modem interfaces.
You can specify whether a filter applies to packets entering the interface (input
filter) or leaving the interface (output filter). The router examines the filtering rules
to determine whether the interface accepts or rejects the packet.
Input Filter If an input filter is configured on an interface, all received packets are checked
against the filtering rules before being forwarded to another interface.
Output Filters If an output filter is configured on an interface, all outbound packets are checked
against the filtering rules before exiting the router.
Input Filters vs. Output
Filters
When possible, use the input filter to filter an incoming packet rather than waiting
to catch a packet as it attempts to exit the router. This is recommended because:
A packet is prevented from entering the router, keeping potential intruders
from attacking the unit itself.
The routing engine does not waste time processing a packet that is going to be
discarded anyway.
Most importantly, the router does not know which interface an outgoing
packet came in through. If a potential intruder forges a packet with a false
source address (in order to appear as a trusted host or network), there is no
way for an output filter to tell if that packet came in through the wrong
interface. An input filter, on the other hand, can filter out packets purporting
to be from networks that are actually connected to a different interface.
VC/Remote Site Filters You can configure filters for a specific VC / remote site profile that controls access
to the network for that location. This filter is only applied for the duration of the
remote network connection. As with interface filters, a remote site filter can be
configured to apply to input or output data traffic.
Applying Filters Using
CLI
You can apply filters to interfaces and/or users using the CLI. If you modify a file,
you need to re-assign it to make the changes take effect immediately. Otherwise
the changes will not take effect until the protocol network (IP, IPX, or bridge) that
the filter affects goes down and comes back up. This occurs when a network is
disabled, the WAN connection goes down then up, or when the OfficeConnect
Remote 812 is rebooted.