ZyXEL Communications Prestige 642 User manual

Prestige 642
ADSL Router
User's Guide
Version 2.50
(May 2000)
ZyXEL
TOTAL INTERNET ACCESS SOLUTION

Getting Started
I
Part I:
Getting Started
Chapters 1-3 are structured as a step-by-step guide to help you connect, install and setup your
Prestige to operate on your network and access the Internet.

Advanced Applications
II
Part II:
Advanced Applications
Advanced Applications (Chapters 4-7) describe the advanced applications of your Prestige, such
as Remote Node Setup IP Static routes and NAT.

Advanced Management
III
Part III:
Advanced Management
Chapters 8 - 12 provide information on Prestige Filtering, SNMP, System Maintenance, IP Policy
Routing, Troubleshooting as well as some Appendices and a Glossary.

Prestige 642 ADSL Internet Access Router
Filter Configuration 8-1
Chapter 8
Filter Configuration
This chapter shows you how to create and apply filter(s).
8.1 About Filtering
Your Prestige uses filters to decide whether to allow passage of a data packet and/or to make a call. There
are two types of filter applications: data filtering and call filtering. Filters are subdivided into device and
protocol filters, which are discussed later.
Data filtering screens the data to determine if the packet should be allowed to pass. Data filters are divided
into incoming and outgoing filters, depending on the direction of the packet relative to a port. Data filtering
can be applied on either the WAN side or the Ethernet side. Call filtering is used to determine if a packet
should be allowed to trigger a call. Remote node call filtering is only applicable when using PPPoE
encapsulation. Outgoing packets must undergo data filtering before they encounter call filtering as shown in
the following figure.
Figure 8-1 Outgoing Packet Filtering Process
For incoming packets, your Prestige applies data filters only. Packets are processed depending upon
whether a match is found. The following sections describe how to configure filter sets.
Data
Filtering
Outgoing
Packet
Drop
packet
Built-in
default
Call Filters
User-defined
Call Filters
(if applicable)
Initiate call
if line not up
Active Data
Send packet
and reset
Idle Timer
Or Or
Drop packet
if line not up
Drop packet
if line not up
Send packet
but do not reset
Idle Timer
Send packet
but do not reset
Idle Timer
Match MatchMatch
No
match
No
match
No
match
Call Filtering

Prestige 642 ADSL Internet Access Router
8-2 Filter Configuration
8.1.1 The Filter Structure of the Prestige
A filter set consists of one or more filter rules. Usually, you would group related rules, e.g., all the rules for
NetBIOS, into a single set and give it a descriptive name. The Prestige allows you to configure up to twelve
filter sets with six rules in each set, for a total of 72 filter rules in the system. You cannot mix device filter
rules and protocol filter rules within the same set. You can apply up to four filter sets to a particular port to
block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24
rules active for a single port.
Three sets of factory default filter rules have been configured in Menu 21 to prevent NetBIOS traffic from
triggering calls and to prevent incoming telnetting. A summary of their filter rules is shown in the figures
that follow.
The following diagram illustrates the logic flow when executing a filter rule.

Prestige 642 ADSL Internet Access Router
Filter Configuration 8-3
Start
Fetch First
Filter Set
Fetch First
Filter Rule
Active?
Execute
Filter Rule
Fetch Next
Filter Rule
Next filter
Rule
Available?
Fetch Next
Filter Set
Next Filter Set
Available?
Accept PacketDrop Packet
Yes
No
Yes
No
Yes
Packet into
filter
Filter Set
Forward
Drop
No
Check
Next
Rule
Figure 8-2 Filter Rule Process
You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter
set having up to six rules, you can have a maximum of 24 rules active for a single port.

Prestige 642 ADSL Internet Access Router
8-4 Filter Configuration
8.2 Configuring a Filter Set
To configure a filter set, follow the procedure below.
Step 1. Enter 21 from the Main Menu to open Menu 21.
Figure 8-3 Menu 21 – Filter Setup
Step 2. Enter the index number of the filter set (no. 1-12) you wish to configure and press [ENTER].
Step 3. Enter a descriptive name or comment in the Edit Comments field and press [ENTER].
Step 4. Press [ENTER] at the message: [Press ENTER to confirm] to open Menu 21.1.1 - Filter Rules
Summary.
Menu 21 - Filter Set Configuration
Filter Filter
Set # Comments Set # Comments
------ ----------------- ------ -----------------
1 NetBIOS_WAN 7 _______________
2 NetBIOS_LAN 8 _______________
3 TELNET_WAN 9 _______________
4 PPPoE 10 _______________
5 _______________ 11 _______________
6 _______________ 12 _______________
Enter Filter Set Number to Configure= 0
Edit Comments= N/A
Press ENTER to Confirm or ESC to Cancel:

Prestige 642 ADSL Internet Access Router
Filter Configuration 8-5
Figure 8-4 NetBIOS_WAN Filter Rules Summary
Figure 8-5 NetBIOS _LAN Filter Rules Summary
Figure 8-6 Telnet_WAN Filter Rules Summary
Menu 21.2 - Filter Rules Summary
# A Type Filter Rules M m n
- - ---- -------------------------------------------- --------- - - -
1 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=53 N D F
2 Y
3 Y
4 Y
5 Y
6 Y
Enter Filter Rule Number (1-6) to Configure:
Menu 21.3 - Filter Rules Summary
# A Type Filter Rules M m n
- - ---- --------------------------------------------------------------- - - -
1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=23 N D F
2 N
3 N
4 N
5 N
6 N
Enter Filter Rule Number (1-6) to Configure:
Menu 21.1 - Filter Rules Summary
# A Type Filter Rules M m n
- - ---- -------------------------------------------- --------- - - -
1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=137 N D N
2 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=138 N D N
3 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=139 N D N
4 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=137 N D N
5 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=138 N D N
6 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=139 N D F
Enter Filter Rule Number (1-6) to Configure:
Press ENTER to Confirm or ESC to Cancel:

Prestige 642 ADSL Internet Access Router
8-6 Filter Configuration
Figure 8-7 PPPoE Filter Rules Summary
8.2.1 Filter Rules Summary Menu
This screen shows the summary of the existing rules in the filter set. The following tables contain a brief
description of the abbreviations used in the previous menus.
Table 8-1 Abbreviations Used in the Filter Rules Summary Menu
Abbreviations Description Display
# Refers to the filter rule number (1-6).
A Shows whether the rule is active or not. [Y] means the filter rule is active.
[N] means the filter rule is inactive.
Type Refers to the type of filter rule.
This shows GEN for generic, IP for
TCP/IP
[GEN] for Generic
[IP] for TCP/IP
Filter Rules The filter rule parameters will be
displayed here (see below).
MRefers to More. More in a set behaves
like a logical AND i.e., the set is only
matched if ALL rules in it are matched.
[Y] means an action can not yet be taken
as there are more rules to check, which
are concatenated with the present rule
to form a rule chain. When the rule chain
is complete an action can be taken.
[Y] means there are more rules to check.
[N] means there are no more rules to check.
Menu 21.4 - Filter Rules Summary
# A Type Filter Rules M m n
- - ---- --------------------------------------------------------------- - - -
1 Y Gen Off=12, Len=2, Mask=ffff, Value=8863 N F N
2 Y Gen Off=12, Len=2, Mask=ffff, Value=8864 N F D
3 N
4 N
5 N
6 N
Enter Filter Rule Number (1-6) to Configure:

Prestige 642 ADSL Internet Access Router
Filter Configuration 8-7
[N] means you can now specify an action
to be taken i.e., forward the packet, drop
the packet or check the next rule. For the
latter, the next rule is independent of the
rule just checked.
If More is Yes, then Action Matched and
Action Not Matched will be N/A
mRefers to Action Matched.
[F] means to forward the packet
immediately and skip checking the
remaining rules.
[F] means to forward the packet.
[D] means to drop the packet.
[N] means check the next rule.
nRefers to Action Not Matched.
[F] means to forward the packet
immediately and skip checking the
remaining rules.
[F] means to forward the packet.
[D] means to drop the packet.
[N] means check the next rule.
The protocol dependent filter rules abbreviation are listed as follows:
zIf the filter type is IP, the following abbreviations listed in the following table will be used.
Table 8-2 Abbreviations Used If Filter Type Is IP
Abbreviation Description
Pr Protocol
SA Source Address
SP Source Port number
DA Destination Address
DP Destination Port number
•Abbreviations Used If Filter Type Is IPX
Table 8-3 Abbreviations Used If Filter Type Is IPX
Abbreviation Description
PT IPX Packet Type
SS Source Socket
DS Destination Socket
zIf the filter type is GEN (generic), the following abbreviations listed in the following table will be
used.

Prestige 642 ADSL Internet Access Router
8-8 Filter Configuration
Table 8-4 Abbreviations Used If Filter Type Is GEN
Abbreviation Description
Off Offset
Len Length
Refer to the next section for information on configuring the filter rules.
8.2.2 Configuring a Filter Rule
To configure a filter rule, type its number in Menu 21.1 - Filter Rules Summary and press [ENTER] to
open Menu 21.1.1 for the rule.
There are three types of filter rules: TCP/IP, IPX and Generic. Depending on the type of rule, the
parameters below the type will be different. Use the space bar to select the type of rule that you wish to
create in the Filter Type field and press ENTER to open the respective menu.
To speed up filtering, all rules in a filter set must be of the same class, i.e., protocol filters or generic filters.
The class of a filter set is determined by the first rule that you create. When applying the filter sets to a
port, separate menu fields are provided for protocol and device filter sets. If you include a protocol filter set
in a device filters field or vice versa, the Prestige will warn you and will not allow you to save.
8.2.3 TCP/IP Filter Rule
This section shows you how to configure a TCP/IP filter rule. TCP/IP rules allow you to base the rule on
the fields in the IP and the upper layer protocol, e.g., UDP and TCP, headers.
To configure a TCP/IP rules, select TCP/IP Filter Rule from the Filter Type field and press ENTER to open
Menu 21.1.1 - TCP/IP Filter Rule, as shown below.

Prestige 642 ADSL Internet Access Router
Filter Configuration 8-9
Figure 8-8 Menu 21.1.1.1 - TCP/IP Filter Rule
The following table describes how to configure your TCP/IP filter rule.
Table 8-5 TCP/IP Filter Rule Menu Fields
Field Description Option
Active This field activates/deactivates the filter rule. Yes/No
IP Protocol Protocol refers to the upper layer protocol, e.g., TCP is 6,
UDP is 17 and ICMP is 1. This value must be between 0
and 255
0-255
IP Source Route If Yes, the rule applies to packet with IP source route
option; else the packet must not have source route option.
The majority of IP packets do not have source route.
Yes/No
Destination: IP
Address
Enter the destination IP Address of the packet you wish to
filter. This field is a don’t-care if it is 0.0.0.0.
IP address
Destination: IP
Mask
Enter the IP mask to apply to the Destination: IP Addr. IP mask
Destination: Port # Enter the destination port of the packets that you wish to
filter. The range of this field is 0 to 65535. This field is a
don’t-care if it is 0.
0-65535
Menu 21.1.1 - TCP/IP Filter Rule
Filter #: 1,1
Filter Type= TCP/IP Filter Rule
Active= Yes
IP Protocol= 6 IP Source Route= No
Destination: IP Addr= 0.0.0.0
IP Mask= 0.0.0.0
Port #= 137
Port # Comp= Equal
Source: IP Addr= 0.0.0.0
IP Mask= 0.0.0.0
Port #=
Port # Comp= None
TCP Estab= No
More= No Log= None
Action Matched= Drop
Action Not Matched= Check Next Rule
Press ENTER to Confirm or ESC to Cancel:
Press Space Bar to Toggle.

Prestige 642 ADSL Internet Access Router
8-10 Filter Configuration
Field Description Option
Destination: Port #
Comp
Select the comparison to apply to the destination port in
the packet against the value given in Destination: Port #.
None/Less/Greater/
Equal/Not Equal]
Source: IP Address Enter the source IP Address of the packet you wish to
filter. This field is a don’t-care if it is 0.0.0.0.
IP Address
Source: IP Mask Enter the IP mask to apply to the Source: IP Addr. IP Mask
Source: Port # Enter the source port of the packets that you wish to filter.
The range of this field is 0 to 65535. This field is a don’t-
care if it is 0.
0-65535
Source: Port #
Comp
Select the comparison to apply to the source port in the
packet against the value given in Source: Port #.
None/Less/Greater/
Equal/Not Equal
TCP Estab This field is applicable only when IP Protocol field is 6,
TCP. If yes, the rule matches only established TCP
connections; else the rule matches all TCP packets.
Yes/No
More If yes, a matching packet is passed to the next filter rule
before an action is taken; else the packet is disposed of
according to the action fields.
If More is Yes, then Action Matched and Action Not
Matched will be N/A.
Yes / No
Log Select the logging option from the following:
zNone – No packets will be logged.
zAction Matched - Only packets that match the rule
parameters will be logged.
zAction Not Matched - Only packets that do not
match the rule parameters will be logged.
zBoth – All packets will be logged.
None
Action Matched
Action Not Matched
Both
Action Matched Select the action for a matching packet. Check Next Rule
Forward
Drop
Action Not Matched Select the action for a packet not matching the rule. Check Next Rule
Forward
Drop

Prestige 642 ADSL Internet Access Router
Filter Configuration 8-11
Field Description Option
Once you have completed filling in Menu 21.1.1 - TCP/IP Filter Rule, press [ENTER] at the message
[Press ENTER to Confirm] to save your configuration, or press [Esc] to cancel. This data will now be
displayed on Menu 21.1 - Filter Rules Summary.
The following diagram illustrates the logic flow of an IP filter.

Prestige 642 ADSL Internet Access Router
8-12 Filter Configuration
Packet
into IP Filter
Matched
Matched
Yes
Action Matched
Action Not Matched
More?
No
Filter Active?
Check
IP Protocol
Drop
Drop Packet Accept Packet
Drop Forward
Check Next Rule
Check Next Rule
Check Next Rule
Forward
Not Matched
Yes
No
Check Src
IP Addr
Apply SrcAddrMask
to Src Addr
Matched
Check Dest
IP Addr
Apply DestAddrMask
to Dest Addr
Not Matched
Not Matched
Check Src &
Dest Port
Matched
Not Matched
Figure 8-9 Executing an IP Filter

Prestige 642 ADSL Internet Access Router
Filter Configuration 8-13
8.2.4 Generic Filter Rule
This section shows you how to configure a generic filter rule. The purpose of generic rules is to allow you
to filter non-IP packets. For IP, it is generally easier to use the IP rules directly.
For generic rules, the Prestige treats a packet as a byte stream as opposed to an IP or IPX packet. You
specify the portion of the packet to check with the Offset (from 0) and the Length fields, both in bytes. The
Prestige applies the Mask (bit-wise ANDing) to the data portion before comparing the result against the
Value to determine a match. The Mask and Value are specified in hexadecimal numbers. Note that it takes
two hexadecimal digits to represent a byte, so if the length is 4, the value in either field will take 8 digits,
e.g., FFFFFFFF.
To configure a generic rule, select Generic Filter Rule in the Filter Type field in the Menu 21.6.1 and press
[ENTER] to open Generic Filter Rule, as shown below.
Figure 8-10 Generic Filter Rule
The following table describes the fields in the Generic Filter Rule Menu.
Table 8-6 Generic Filter Rule Menu Fields
Field Description Option
Filter # This is the filter set, filter rule co-ordinates, i.e., 2,3 refers to the second
filter set and the third rule of that set.
Filter Type Use the [SPACE BAR] to toggle between both types of rules. Parameters
displayed below each type will be different.
Generic Filter
Rule/ TCP/IP
Filter Rule
Active Select Yes to turn on the filter rule. Yes/No
Menu 21.6.1 - Generic Filter Rule
Filter #: 6,1
Filter Type= Generic Filter Rule
Active= No
Offset= 0
Length= 0
Mask= N/A
Value= N/A
More= No Log= None
Action Matched= Check Next Rule
Action Not Matched= Check Next Rule
Press ENTER to Confirm or ESC to Cancel:
Press Space Bar to Toggle.

Prestige 642 ADSL Internet Access Router
8-14 Filter Configuration
Field Description Option
Offset Enter the starting byte of the data portion in the packet that you wish to
compare. The range for this field is from 0 to 255.
Default = 0
Length Enter the byte count of the data portion in the packet that you wish to
compare. The range for this field is 0 to 8.
Default = 0
Mask Enter the mask (in Hexadecimal) to apply to the data portion before
comparison.
Value Enter the value (in Hexadecimal) to compare with the data portion.
More If yes, a matching packet is passed to the next filter rule before an action is
taken; else the packet is disposed of according to the action fields.
If More is Yes, then Action Matched and Action Not Matched will be No.
Yes / No
Log Select the logging option from the following:
zNone – No packets will be logged.
zAction Matched - Only packets that match the rule parameters will
be logged.
zAction Not Matched - Only packets that do not match the rule
parameters will be logged.
zBoth – All packets will be logged.
None
Action
Matched
Action Not
Matched
Both
Action
Matched
Select the action for a matching packet. Check Next
Rule
Forward
Drop
Action Not
Matched
Select the action for a packet not matching the rule. Check Next
Rule
Forward
Drop
Once you have completed filling in Menu 21.4.1.1 - Generic Filter Rule, press [ENTER] at the message
[Press ENTER to Confirm] to save your configuration, or press [Esc] to cancel. This data will now be
displayed on Menu 21.1.1 - Filter Rules Summary.
8.2.5 Novell IPX Filter Rule
This section shows you how to configure an IPX filter rule. IPX filters allow you to base the rules on the
fields in the IPX headers.

Prestige 642 ADSL Internet Access Router
Filter Configuration 8-15
To configure an IPX rules, select IPX Filter Rule from the Filter Type field and press [ENTER} to open
Menu 21.1.5 IPX Filter Rule, as shown in the figure below.
Figure 8-11 IPX Filter Rule
Menu 21.1.5 - IPX Filter Rule
Filter #: 5,1
Filter Type= IPX Filter Rule
Active= No
IPX Packet Type=
Destination: Network #=
Node #=
Socket #=
Socket # Comp= None
Source: Network #=
Node #=
Socket #=
Socket # Comp= None
Operation= N/A
More= No Log= None
Action Matched= Check Next Rule
Action Not Matched= Check Next Rule
Press ENTER to Confirm or ESC to Cancel:
Press Space Bar to Toggle.