ZyXEL Communications Prestige 642 User manual

Prestige 642
ADSL Router
User's Guide
Version 2.50
(May 2000)
ZyXEL
TOTAL INTERNET ACCESS SOLUTION

Getting Started
I
Part I:
Getting Started
Chapters 1-3 are structured as a step-by-step guide to help you connect, install and setup your
Prestige to operate on your network and access the Internet.

Advanced Applications
II
Part II:
Advanced Applications
Advanced Applications (Chapters 4-7) describe the advanced applications of your Prestige, such
as Remote Node Setup IP Static routes and NAT.

Advanced Management
III
Part III:
Advanced Management
Chapters 8 - 12 provide information on Prestige Filtering, SNMP, System Maintenance, IP Policy
Routing, Troubleshooting as well as some Appendices and a Glossary.

Prestige 642 ADSL Internet Access Router
Filter Configuration 8-1
Chapter 8
Filter Configuration
This chapter shows you how to create and apply filter(s).
8.1 About Filtering
Your Prestige uses filters to decide whether to allow passage of a data packet and/or to make a call. There
are two types of filter applications: data filtering and call filtering. Filters are subdivided into device and
protocol filters, which are discussed later.
Data filtering screens the data to determine if the packet should be allowed to pass. Data filters are divided
into incoming and outgoing filters, depending on the direction of the packet relative to a port. Data filtering
can be applied on either the WAN side or the Ethernet side. Call filtering is used to determine if a packet
should be allowed to trigger a call. Remote node call filtering is only applicable when using PPPoE
encapsulation. Outgoing packets must undergo data filtering before they encounter call filtering as shown in
the following figure.
Figure 8-1 Outgoing Packet Filtering Process
For incoming packets, your Prestige applies data filters only. Packets are processed depending upon
whether a match is found. The following sections describe how to configure filter sets.
Data
Filtering
Outgoing
Packet
Drop
packet
Built-in
default
Call Filters
User-defined
Call Filters
(if applicable)
Initiate call
if line not up
Active Data
Send packet
and reset
Idle Timer
Or Or
Drop packet
if line not up
Drop packet
if line not up
Send packet
but do not reset
Idle Timer
Send packet
but do not reset
Idle Timer
Match MatchMatch
No
match
No
match
No
match
Call Filtering

Prestige 642 ADSL Internet Access Router
8-2 Filter Configuration
8.1.1 The Filter Structure of the Prestige
A filter set consists of one or more filter rules. Usually, you would group related rules, e.g., all the rules for
NetBIOS, into a single set and give it a descriptive name. The Prestige allows you to configure up to twelve
filter sets with six rules in each set, for a total of 72 filter rules in the system. You cannot mix device filter
rules and protocol filter rules within the same set. You can apply up to four filter sets to a particular port to
block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24
rules active for a single port.
Three sets of factory default filter rules have been configured in Menu 21 to prevent NetBIOS traffic from
triggering calls and to prevent incoming telnetting. A summary of their filter rules is shown in the figures
that follow.
The following diagram illustrates the logic flow when executing a filter rule.

Prestige 642 ADSL Internet Access Router
Filter Configuration 8-3
Start
Fetch First
Filter Set
Fetch First
Filter Rule
Active?
Execute
Filter Rule
Fetch Next
Filter Rule
Next filter
Rule
Available?
Fetch Next
Filter Set
Next Filter Set
Available?
Accept PacketDrop Packet
Yes
No
Yes
No
Yes
Packet into
filter
Filter Set
Forward
Drop
No
Check
Next
Rule
Figure 8-2 Filter Rule Process
You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter
set having up to six rules, you can have a maximum of 24 rules active for a single port.

Prestige 642 ADSL Internet Access Router
8-4 Filter Configuration
8.2 Configuring a Filter Set
To configure a filter set, follow the procedure below.
Step 1. Enter 21 from the Main Menu to open Menu 21.
Figure 8-3 Menu 21 – Filter Setup
Step 2. Enter the index number of the filter set (no. 1-12) you wish to configure and press [ENTER].
Step 3. Enter a descriptive name or comment in the Edit Comments field and press [ENTER].
Step 4. Press [ENTER] at the message: [Press ENTER to confirm] to open Menu 21.1.1 - Filter Rules
Summary.
Menu 21 - Filter Set Configuration
Filter Filter
Set # Comments Set # Comments
------ ----------------- ------ -----------------
1 NetBIOS_WAN 7 _______________
2 NetBIOS_LAN 8 _______________
3 TELNET_WAN 9 _______________
4 PPPoE 10 _______________
5 _______________ 11 _______________
6 _______________ 12 _______________
Enter Filter Set Number to Configure= 0
Edit Comments= N/A
Press ENTER to Confirm or ESC to Cancel:

Prestige 642 ADSL Internet Access Router
Filter Configuration 8-5
Figure 8-4 NetBIOS_WAN Filter Rules Summary
Figure 8-5 NetBIOS _LAN Filter Rules Summary
Figure 8-6 Telnet_WAN Filter Rules Summary
Menu 21.2 - Filter Rules Summary
# A Type Filter Rules M m n
- - ---- -------------------------------------------- --------- - - -
1 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=53 N D F
2 Y
3 Y
4 Y
5 Y
6 Y
Enter Filter Rule Number (1-6) to Configure:
Menu 21.3 - Filter Rules Summary
# A Type Filter Rules M m n
- - ---- --------------------------------------------------------------- - - -
1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=23 N D F
2 N
3 N
4 N
5 N
6 N
Enter Filter Rule Number (1-6) to Configure:
Menu 21.1 - Filter Rules Summary
# A Type Filter Rules M m n
- - ---- -------------------------------------------- --------- - - -
1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=137 N D N
2 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=138 N D N
3 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=139 N D N
4 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=137 N D N
5 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=138 N D N
6 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=139 N D F
Enter Filter Rule Number (1-6) to Configure:
Press ENTER to Confirm or ESC to Cancel: