Firewall | Custom

Last Updated : Sep 16, 2022 |
Navigation: Firewall Profile | Custom
Prolog information
Metadata
Keywords:
Resource Id: FirewallCustom:11921
The tab lists custom firewall settings added to the firewall profile. The Add, Edit and Remove controls can be used to amend the settings in the list.
These settings are mergeable. Changes to these settings do not require a reboot of the system.
Field
Description
Notes
For information only. Enter text to remind you of the purpose of the custom firewall record.
Remote IP Address
The IP address of the system at the far end of the link. Blank allows all IP addresses.
Remote IP Mask
The mask to use when checking the Remote IP Address. When left blank no mask is set, equivalent to 255.255.255.255 - allow all.
Local IP Address
The address of devices local to this network (pre-translated). Blank allows all IP addresses.
Local IP Mask
The mask to use when checking the Local IP Address. When left blank no mask is set, equivalent to 255.255.255.255 - allow all.
IP Protocol
The value entered here corresponds to the IP Protocol which is to be processed by this Firewall profile: 1 for ICMP, 6 for TCP, 17 for UDP or 47 for GRE. This information can be obtained from the "pcol" parameter in a Monitor trace.
Match Offset
The offset into the packet (0 = first byte of IP packet) where checking commences for either a specific port number, a range of port numbers, or data.
Match Length
The number of bytes to check in the packet, from the Match Offset point, that are checked against the Match Data and Match Mask settings.
Match Data
The values the data must equal once masked with the Match Mask. This information can be obtained from "TCP Dst" parameter in a Monitor trace (the firewall uses hex so a port number of 80 is 50 in hex)
Match Mask
This is the byte pattern, which is logically ANDed with the data in the packet from the offset point. The result of this process is then compared against the contents of the "Match Data" field.
Direction
The direction that data may take if matching this filter.
Drop
All matching traffic is dropped.
In
Incoming traffic can start a session.
Out
Outgoing traffic can start a session.
Both Directions
Both incoming and outgoing traffic can start sessions.

Example Custom Firewall Records

Dropping NetBIOS searches on an ISPs DNS
We suggest that the following filter is always added to the firewall facing the Internet to avoid costly but otherwise typically pointless requests from Windows machines making DNS searches on the DNS server at your ISP.
  • Direction: Drop
  • IP Protocol: 6 (TCP)
  • Match Offset: 20
  • Match Length: 4
  • Match Data: 00890035
  • Match Mask: FFFFFFFF

Browsing Non-Standard Port Numbers

The radio button for HTTP permits ports 80 and 443 through the firewall. Some hosts use non-standard ports for HTTP traffic, for example 8080, 8000, 8001, 8002, etc. You can add individual filters for these ports as you find them.
You wish to access a web page but you cannot because it uses TCP port 8000 instead of the more usual port 80, use the entry below.
  • Direction: Out
  • IP Protocol: 6 (TCP)
  • Match Offset: 22
  • Match Length: 2
  • Match Data: 1F40
  • Match Mask: FFFF
A more general additional entry given below allows all TCP ports out.
  • Direction: Out
  • IP Protocol: 6 (TCP)
  • Match Offset: 0
  • Match Length: 0
  • Match Data: 00000000000000000000000000000000
  • Match Mask: 00000000000000000000000000000000

Routing All Internet Traffic through a WinProxy

If you wish to put WinProxy in front of all Internet traffic via the Control Unit. The following firewall allows only the WinProxy server to contact the Internet : -
  1. Create a new Firewall profile and select Drop for all protocols
  2. Under Custom create a new Firewall Entry
  3. In Notes enter the name of the server allowed. Then use the default settings except in Local IP Address enter the IP address of the WinProxy Server, in Local IP Mask enter 255.255.255.255 and in Direction select Both Directions.

Stopping PINGs

You wish to stop pings - this is ICMP Filtering. Using the data below can create a firewall filter that performs the following; Trap Pings; Trap Ping Replies; Trap Both.
  • Trap Pings: Protocol = 1, offset = 20, data = 08, mask = FF
  • Trap Ping Replies: Protocol = 1, offset = 20, data = 00, mask = FF
  • Trap Both: Protocol = 1, offset = 20, data = 00, mask = F7, Traps Both.
Related links
Firewall Profile