Filter
Top Products
13-34 User’s Reference Guide
II
II
mm
mm
pp
pp
ll
ll
ii
ii
ee
ee
dd
dd
rr
rr
uu
uu
ll
ll
ee
ee
ss
ss
With a given set of filter rules, there is an implied rule that may or may not be shown to the user. The implied
rule tells the filter set what to do with a packet that does not match any of the filter rules. An example of implied
rules is as follows:
EE
EE
ss
ss
tt
tt
aa
aa
bb
bb
ll
ll
ii
ii
ss
ss
hh
hh
ee
ee
dd
dd
cc
cc
oo
oo
nn
nn
nn
nn
ee
ee
cc
cc
tt
tt
ii
ii
oo
oo
nn
nn
ss
ss
The TCP header contains one bit called the ACK bit (or TCP Ack bit). This ACK bit appears only with TCP, not
UDP. The ACK bit is part of the TCP mechanism that guarantees the delivery of data. The ACK bit is set
whenever one side of a connection has received data from the other side. Only the first TCP packet will not have
the ACK bit set; once the TCP connection is in place, the remainder of the TCP packets with have the ACK bit
set.
The ACK bit is helpful for firewall design and reduces the number of potential filter rules. A filter rule could be
created just allowing incoming TCP packets with the ACK bit set, since these packets had to be originated from
the local network.
EE
EE
xx
xx
aa
aa
mm
mm
pp
pp
ll
ll
ee
ee
II
II
PP
PP
ff
ff
ii
ii
ll
ll
tt
tt
ee
ee
rr
rr
ss
ss
ee
ee
tt
tt
ss
ss
cc
cc
rr
rr
ee
ee
ee
ee
nn
nn
This is an example of the Netopia IP filter set screen:
Implied Meaning
Y+Y+Y=N If all filter rules are YES, the implied rule is NO.
N+N+N=Y If all filter rules are NO, the implied rule is YES.
Y+N+Y=N If a mix of YES and NO filters, the implied rule is NO.
Change Filter
Enabled: Yes
Forward: No
Source IP Address: 0.0.0.0
Source IP Address Mask: 0.0.0.0
Dest. IP Address: 0.0.0.0
Dest. IP Address Mask: 0.0.0.0
Protocol Type: TCP
Source Port Compare... No Compare
Source Port ID: 0
Dest. Port Compare... Equal
Dest. Port ID: 2000
Established TCP Conns. Only: No
Return/Enter accepts * Tab toggles * ESC cancels.
Enter the IP specific information for this filter.