Topic 'Re: FILTERS BLASTOFF...........fizzzzle' in forum 'Netgear'

Topic 'Re: FILTERS BLASTOFF...........fizzzzle' in forum 'Netgear' - dslreports.com http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1282838 en Sat, 26 Mar 2022 14:00:18 EDT Sat, 26 Mar 2022 14:00:18 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1297344
Call filters are only used with PPPoE encapsulation (defined in menu 4 or 11).

Brian]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1297344 Fri, 17 Aug 2001 14:35:53 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1296875
If you use ethernet/cable ISP then the call filters options are not displayed.
--
~AL~]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1296875 Fri, 17 Aug 2001 12:53:48 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1296195 Sometimes I turn on the computer and it seems the connection is not automatic ie thru the browser, I have to prod it with a ping internal or external, or by asking for mail. Is this unusual??]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1296195 Fri, 17 Aug 2001 09:58:39 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1296176 With a call filter you block unimportant maintenance traffic from accidentally triggering a connection.

They filter based on the line status:
If line is down, they block.
If line is up, they pass the packets, but the idle timer is not reset.

For example you could put ICMP into a call filter. If you now ping something on the WAN nothing happens.
Open a browser session and a call is triggered.
Now you will be able to ping, because the line is up.

Without the call filter, the ping alone would also trigger a call. This is only really important if you have measured service and pay by the minute.]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1296176 Fri, 17 Aug 2001 09:54:23 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1295993
What exactly does a "Call Filter" do?
[text was edited by author 2001-08-17 09:00:52]
]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1295993 Fri, 17 Aug 2001 09:00:20 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1293583 http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1293583 Thu, 16 Aug 2001 20:19:42 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1290646 Hey, how come you got the 3 thumbs (it was my thread) J/K

Now if only I understood what all the entries are in menu 21 and what effect they had,, i could be well on my way to designing filters...... and give SYNACK more headaches.

This is a great forum!!]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1290646 Thu, 16 Aug 2001 10:14:04 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1290590 I have placed a revised diagram at the URL below (same as earlier).

»edhample.home.sprynet.co ··· uter.jpg

I have also uploaded a Visio diagram (the actual source of the JPG image). The URL is:

»edhample.home.sprynet.co ··· uter.vsd

Please feel free to make corrections to the Visio diagram - please e-mail the modified file to me and I will correct my master copy accordingly and post the result.

Thanks again for all of the input - both functional and syntactical.

e]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1290590 Thu, 16 Aug 2001 09:59:42 EDT http://www.dslreports.com/forum/-1290050 [text was edited by author 2001-08-16 06:07:08]

]]> http://www.dslreports.com/forum/-1290050 Thu, 16 Aug 2001 06:05:49 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1287546
The diagram is misleading without one more box for internal servers. So I think the servers box is critical.

Regarding call filters, what if you put call filters in an existing box, separating the two filters by a horizontal dividing line? I forgot which box they fit into but that info is in the doc.]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1287546 Wed, 15 Aug 2001 19:22:29 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1287101 Lan should be LAN

SYNACK's and bbarrera's comments are good, but be careful not to make the diagram too complicated! Perhaps you should leave this diagram alone and make an expanded diagram with some more details. K.I.S.S.!!
--
Earthlink/Mindspring/Covad DSL 1.5M/384k; Avg speed 1300k/325k]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1287101 Wed, 15 Aug 2001 17:50:59 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286919
One general comment:

1. I think it would help if you add a box to left/right of routing box that shows the router's internal servers (http, telnet, ftp and DNS proxy servers).

For PPPoE I'll add these comments:

1. Call filters per SYNACKs suggestion

2. You may want to show that Ethernet/PPPoE frames are converted to PPP frames immediately after physical interface and before the generic filters.

3. The embedded packet trace for PPPoE encapsulation sees packets on both enet1 (Ethernet frames) and poe0 (PPP frames).]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286919 Wed, 15 Aug 2001 17:19:30 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286891
Anav]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286891 Wed, 15 Aug 2001 17:14:37 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286846
Jim]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286846 Wed, 15 Aug 2001 17:03:45 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286639
If you want to expand it a little bit:

1. For people with PPPoE, the call filters could be included.

2. Things get even "hairier" if you add the ZyWALL. The Firewall code is yet another box for incoming and outgoing.
(See figure 14.5 in the ZyWALL manual you can download).

3. Also, the embedded packet trace sees the packets after the generic filters, but before NAT. If you have generic filters, certain packets are not seen at all.

[text was edited by author 2001-08-15 16:31:14]
]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286639 Wed, 15 Aug 2001 16:27:48 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286509 --
~AL~]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286509 Wed, 15 Aug 2001 16:00:16 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286219
»edhample.home.sprynet.co ··· uter.jpg

Please review and send me your comments.]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1286219 Wed, 15 Aug 2001 14:59:06 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285742 http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285742 Wed, 15 Aug 2001 13:16:20 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285665
Somehow I thought that the source address information, not just your own WAN IP was available in the incoming packets so thus filterable.

Have you read gibsons GENESIS information at www.grc.com??
»grc.com/r&d/nomoredos3.htm

Interested in what you think of that??
specifically, are his DoS procedures useable by us or is this something netgear has to implement in firmware??

Anav
PS It's the first place I saw ..SYN...ACK...
[text was edited by author 2001-08-15 13:07:47]]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285665 Wed, 15 Aug 2001 12:57:38 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285574
»www.zyxel.com/support/su ··· ex_f.htm

e]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285574 Wed, 15 Aug 2001 12:39:55 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285446
NO, before NAT every single packet has your WAN IP as destination, thus this field is completely uninteresting and useless because it does not carry any information (you already know your WAN IP!). You might as well unplug the cable instead of filtering based on destination IP before NAT. After NAT translation the destination is the LAN target, so you can filter based on the NAT state, e.g. block traffic to a certain user. This is more flexible.]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285446 Wed, 15 Aug 2001 12:07:27 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285398
Take a page from Ed there SYNACK... his clear language is refreshing (like a cold fresca) :-p.

Is what you meant to say:

Traffic, from the internet, is generic 'input' filtered [packet specific] prior to the NAT in the router.
After NAT, protocol 'input' filtering [IPaddress/Portaddress filtering] is applied.

At this point in time IP addresses that will reach the LAN have been converted already from the WAN IP address for the applicable recipient LAN puters.

My only question here is, why would one not want to filter out unwanted protocol, ie an unwanted external IP address prior to NAT translation? More efficient?

Next step is applied prior to data entering the local subnet. You describe these as LAN OUTPUT???? Should that not have been LAN INPUT protocol and generic filters???

That is assuming the reverse ....information sent outside the LAN from inside the subnet would first go through LAN OUTPUT filters.

Next the data would cross the WAN protocol OUTPUT filters, then process through the NAT and then be subjected to the WAN generic output filters

Clear as Mud
Anav]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285398 Wed, 15 Aug 2001 11:54:25 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285184 E.g. incoming:

WAN -> generic WAN input filters -> NAT translation -> protocol WAN input filters -> routing -> LAN output and generic filters -> LAN

NAT translation is important to know, because the destination IP needed in protocol filters is already the LAN target.

Similar for outgoing packets. If you are on PPPoE, you also have call filters. They block depending on the state of your LAN connection.

See also:
»www.zyxel.com/support/su ··· _how.htm
[text was edited by author 2001-08-15 11:01:47]]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285184 Wed, 15 Aug 2001 10:53:34 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285154
ALL filters are DEFINED in menu 21 - but menu 21 does not determine how and when they are applied.

Menu 3.1 - LAN Port Filter Setup - controls which filters are applied to traffic coming into or leaving the local network.

Menu 11.5 - Remote Node Filters - controls which filters are applied to traffic entering or leaving the router via the INTERNET (WAN) port.

Now my questions:

On menu 3.1 and 11.5 - How are "input" and "output" defined? Input and Output to what?, from what?

I guess what I am really asking is - what is the architecture of the RT314 and where do the filters fit in?

My impression is that the router is organized something like:

LAN<->[filters]<->[Router]<->[filters]<-> WAN

If this is accurate, traffic on the RT314's 4 switched LAN ports would travel through the LAN unfiltered. Anything that is not in the local subnet will be subjected to the filters in menu 3.1. Upon leaving the router, they would be subjected to the filters defined in menu 11.5.

Incoming packets from the Internet are subjected to the filters in 11.5 before passing through the router. From the router they will hit the filters on 3.1 before entering the local LAN.

Am I on the right track, or should I reboot by brain and start over?]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1285154 Wed, 15 Aug 2001 10:44:58 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1284914 said by Anav:

Thanks man feel a bit of progress here. Thus what your saying is that the menu 11.5 input filter protocol should have the number 4 in it (in my case) to reflect the filter set number 4 that I have defined in menu 21. If this is true good!

Yes. Correct.

said by Anav:
Next, why Am I putting a number 1 in the output filter protocol? Shouldn't that be a number 4 as well???? [ isn't that referring to the default filter set number 1 and thus I should remove it????]

#1 is one of the default filters. If you deleted or are not using it then you can remove it from that spot. If you replaced it with your own filter then you may want to leave it there. This location is where you apply the filters that are made in menu 21. If you have a filter #1 and you want it to be applied to incoming traffic then you would list it here.

said by Anav:
Thirdly this is not the only place to "activate" filters defined in menu 21?? I noted in menu 3 lan port selection that there is a page LAN port filter setup. I noted here there is a number two for input filter protocol [ Again does this not refer to the default filter set 2 - and should I remove this????]

Correct. Menu 3 is LAN filters. #2 is one of the three default filters. Again, if you are not using it then you can delete it here as it is not used. Menu 3 does not apply to incoming traffic from the web. Menu 11.5 applied to traffic going out to or coming in from the web.

said by Anav:
Lastly, I could not find anywhere a similar WAN filter setup???? where is it hiding or is it covered by all entries in menu 11????

Please explain. The default filter #3 is the only filter that filters incoming traffic from the outside world. aka the web or WAN side. In firmware 3.25 it is not used anymore so it is listed in menu 21 but not applied in menu 11.5.

said by Anav:
PS. I understood your cascading info but, i only need one filter set according to the gurus, but thanx anyway!

If your filter #4 is the only filter you are applying to the incoming WAN side then it would be the only filter listed under Input Filter sets -> Protocol Filters. The last rule would be forward since there is no next rule to check.
--
~AL~]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1284914 Wed, 15 Aug 2001 09:39:20 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1284615
Next, why Am I putting a number 1 in the output filter protocol? Shouldn't that be a number 4 as well???? [ isn't that referring to the default filter set number 1 and thus I should remove it????]

Thirdly this is not the only place to "activate" filters defined in menu 21?? I noted in menu 3 lan port selection that there is a page LAN port filter setup. I noted here there is a number two for input filter protocol [ Again does this not refer to the default filter set 2 - and should I remove this????]

Lastly, I could not find anywhere a similar WAN filter setup???? where is it hiding or is it covered by all entries in menu 11????

PS. I understood your cascading info but, i only need one filter set according to the gurus, but thanx anyway!

Anav]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1284615 Wed, 15 Aug 2001 07:58:49 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1283834 said by Anav:

Also still confused on menu 11.5, there is not a separate entry for each of the filter sets???? Just one page so how to enter it is a mystery

Below is an example of what your menu 11.5 may look like.
In this example I have shown how you could chain two filter sets together, in this example filter set 4 and set 7.
These are the Set # from menu 21. You can chain a maximum of 4 filter sets in any of the fields below that is Input Filter Sets, can have a max of 4 filters, Output Filter Sets max of 4, etc.

To chain filters together the last rule of the filter in this case the last rule of filter 4 must be Check Next Rule as show below. This allows the packet to be passed onto the next filter set which is filter 7.

Action Matched= (Drop or Forward)
Action Not Matched= Check Next Rule

Now for the last rule of filter 7, it must have Action not matched set to either Forward or Drop. In most cases it would be set to Forward though.

        Menu 11.5 - Remote Node Filter

   Input Filter Sets:
     protocol filters= 4,7
       device filters= 
   Output Filter Sets:
     protocol filters= 1
       device filters= 6

As you can see to chain filters together you place a comma between the filter numbers.
The order of these numbers is the order that they will be processed by the router]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1283834 Wed, 15 Aug 2001 00:58:46 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1283118 I will fix that and ensure that I hit enter enter enter to get Dp=53 ie into the ROM.

Okay Got DP = 53 working now. I noted in Lan setup that there was an entry of the number 2 for 1st protocols setting????

Also still confused on menu 11.5, there is not a separate entry for each of the filter sets???? Just one page so how to enter it is a mystery. I did change 1 / 1 to 4 / 1 for the I/O protocols...

netgear phone support was not able to answer my last question. LOL
[text was edited by author 2001-08-14 22:58:32]
]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1283118 Tue, 14 Aug 2001 22:47:57 EDT Re: FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1283056 Port # Comp= Equal?

Menu 11.5 lists the filter sets, by filter set number, to be applied and the order in which to apply them. I didn't go and look at the specific filters you're trying to use, but I believe you want to enter a 4 for the Input Filter Sets, and a 1 for the Output Filter Sets (in each case for the protocol filters).

Sorry for the short answer, but I hope this helps...
--
Earthlink/Mindspring/Covad DSL 1.5M/384k; Avg speed 1300k/325k

[text was edited by author 2001-08-14 22:39:31]
]]> http://www.dslreports.com/forum/Re-FILTERS-BLASTOFFfizzzzle-1283056 Tue, 14 Aug 2001 22:36:14 EDT FILTERS BLASTOFF...........fizzzzle http://www.dslreports.com/forum/FILTERS-BLASTOFFfizzzzle-1282838 Q1. Is this omission in the summary page normal?

I finally figured out how to reach Menu 11.5, thanks for the lack of information LOL, ie use "edit filter set" the 5th tab entry hence the point 5 LOL. Took me a while to get there...
C1 Don't forget to include this minor step in future instructions for newbies like me (or telnet challenged).

I noted the three filters already in menu 21. So I used slot number 4 (you may have figured that out already). When I got to menu 11.5, I did as instructed and put in 1 and 1 (input/output protocol filters).
Q1 Should I have put in a 4 instead of a 1
[ I don't think so , I get the feeling its not for identifying the filter set but how many????]

Q2 How does this entry know which of filter sets to use??

Q3 How do I know which of the 4 filter sets are actually active (read that the first 3 are defaulted off.....where is the indication of this status)

Q4 Should I delete the other three?? then 1 and 1 would be effective???

Lost in Filter Space
Anav

Should Add.. RT314, Shaw Cable, w98Se
[text was edited by author 2001-08-14 21:58:44]
]]> http://www.dslreports.com/forum/FILTERS-BLASTOFFfizzzzle-1282838 Tue, 14 Aug 2001 21:57:10 EDT