Filter Example

A filter for blocking the web connections from LAN

- Introduction

If you want to avoid the outbound Web request to trigger a call to the remote web server, you can configure a call filter set in Prestige to block this packet. After the call filter is applied, the Web packet will not triggered the call to your ISP or remote node. However, when the call is trigger by the other packets and the Internet connection is established, the workstations then are able to access the Web page.

- Configuration

Before configuring a filter, you need to know the following information:

1. The outbound packet type (protocol & port number)
2. The source IP address

Generally, the outbound packets for Web service could be as following:

a. HTTP packet, TCP (06) protocol with port number 80
b. DNS packet, TCP (06) protocol with port number 53 or
c. DNS packet, UDP (17) protocol with port number 53

For all workstation on the LAN, the source IP address will be 0.0.0.0. Otherwise, you have to enter an IP Address for the workstation you want to block. See the procedure for configuring this filter below.

- Create a filter set in Menu 21, e.g., set 1
- Create three filter rules in Menu 21.1.1, Menu 21.1.2, Menu 21.1.3

- Rule 1- block the HTTP packet, TCP (06) protocol with port number 80
- Rule 2- block the DNS packet, TCP (06) protocol with port number 53
- Rule 3- block the DNS packet, UDP (17) protocol with port number 53

- Apply the filter set in remote node, Menu 11

- Create a filter set in Menu 21

`Menu 21 - Filter Set Configuration` `Filter Filter` `Set # Comments Set # Comments` `------ ----------------- ------ -----------------` `1 Web Request 7 _______________` `2 8 _______________` `3 9 _______________` `4 10 _______________` `5 11 _______________` `6 _______________ 12 _______________` `Enter Filter Set Number to Configure= 1` `Edit Comments=` `Press ENTER to Confirm or ESC to Cancel:` ``

- Rule one for (a). http packet, TCP(06)/Port number 80

`` `Menu 21.1.1 - TCP/IP Filter Rule` `Filter #: 1,1` `Filter Type= TCP/IP Filter Rule` `Active= Yes` `IP Protocol= 6 IP Source Route= No` `Destination: IP Addr= 0.0.0.0` `IP Mask= 0.0.0.0` `Port #= 80` `Port # Comp= Equal` `Source: IP Addr= 0.0.0.0` `IP Mask= 0.0.0.0` `Port #=` `Port # Comp= None` `TCP Estab= No` `More= No Log= None` `Action Matched= Drop` `Action Not Matched= Check Next Rule` `Press ENTER to Confirm or ESC to Cancel:`

- Rule 2 for (b).DNS request, TCP(06)/Port number 53

`` `Menu 21.1.2 - TCP/IP Filter Rule` `Filter #: 1,2` `Filter Type= TCP/IP Filter Rule` `Active= Yes` `IP Protocol= 6 IP Source Route= No` `Destination: IP Addr= 0.0.0.0` `IP Mask= 0.0.0.0` `Port #= 53` `Port # Comp= Equal` `Source: IP Addr= 0.0.0.0` `IP Mask= 0.0.0.0` `Port #=` `Port # Comp= None` `TCP Estab= No` `More= No Log= None` `Action Matched= Drop` `Action Not Matched= Check Next Rule` `Press ENTER to Confirm or ESC to Cancel:`

- Rule 3 for (c). DNS packet UDP(17)/Port number 53

`Menu 21.1.2 - TCP/IP Filter Rule` `Filter #: 1,2` `Filter Type= TCP/IP Filter Rule` `Active= Yes` `IP Protocol= 17 IP Source Route= No` `Destination: IP Addr= 0.0.0.0` `IP Mask= 0.0.0.0` `Port #= 53` `Port # Comp= Equal` `Source: IP Addr= 0.0.0.0` `IP Mask= 0.0.0.0` `Port #=` `Port # Comp= None` `TCP Estab= No` `More= No Log= None` `Action Matched= Drop` `Action Not Matched= Forward` `Press ENTER to Confirm or ESC to Cancel:`

- After the three rules are completed, you will see the rule summary in Menu 21.

`Menu 21.1 - Filter Rules Summary` `# A Type Filter Rules M m n` `- - ---- ------------------------------------- - - -` `1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, N D N` `2 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, N D N` `3 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, N D F` ``

- Then put the filter set number '1' in the 'Call Filter Set' field of SMT menu 11.5 for taking active.

`Menu 11.1 - Remote Node Profile` `Rem Node Name= Hinet Route= IP` `Active= Yes Bridge= No` `Call Direction= Outgoing Edit PPP Options= No` `Incoming: Rem IP Addr= 0.0.0.0` `Rem Login= N/A Edit IP/IPX/Bridge= No` `Rem Password= N/A Telco Option:` `Rem CLID= N/A Allocated Budget(min)= 5` `Call Back= N/A Period(hr)= 1` `Outgoing: Transfer Type= 64K` `My Login= qwer Nailed-Up Connection= No` `My Password= ******** Session Options:` `Authen= CHAP/PAP Edit Filter Sets= Yes` `Pri Phone #= 4125678 Idle Timeout(sec)= 300` `Sec Phone #=` `Press ENTER to Confirm or ESC to Cancel:`

`Menu 11.5 - Remote Node Filter` `Input Filter Sets:` `protocol filters=` `device filters=` `Output Filter Sets:` `protocol filters=` `device filters=` `Call Filter Sets:` `protocol filters= 1` `device filters=`

All contents copyright © 1999 ZyXEL Communications Corporation.