1. Hardware Firewalls: Advanced Feature © N. Ganesan, Ph.D.

2. Chapter Objective Discuss various additional and important features of a firewall –DHCP –Virtual server –Enabling applications that require multiple connections –Filters (IP, MAC etc. ) –Firewall rules regulating traffic –DMZ –Remote management –etc.

3. Module WAN Side IP Specifications © N. Ganesan, Ph.D.

4. WAN Side IP In the case of the firewall/switch, an address for the firewall must be specified for both the WAN side and the LAN side –The LAN side address will be a private address that is not visible to the Internet

5. IP Options Static IP –Demonstrated early Dynamic IP –Cable modem and LAN Internet sharing –Could also be employed in the case of DSL PPPoE –DSL specific

13. Module LAN Side IP Specification © N. Ganesan, Ph.D.

14. IP Options Generally speaking, a static private IP is specified for the firewall/switch for the LAN side

16. Module DHCP © N. Ganesan, Ph.D.

17. DHCP Enabling DHCP can be enabled to deliver dynamic IP addresses for all the LAN side clients At the same time, static IP addresses can be assigned to selected clients based on their MAC addresses

19. Change this slide, make it enabled.

22. Module Advanced Features © N. Ganesan, Ph.D.

23. Advanced Features Virtual servers Applications Filters Firewalls DMZ

24. Virtual Servers Opening a port through the firewall to give access to a web server that is hosted on the private LAN

26. Web Server Settings Private IP address: 192.168.0.1 Public Port: 80 Private Port: 80 Availability: Always

28. Another Way to Set the Web Server Pass Through Select from the virtual server list and edit the entry

30. Edit

32. Other servers

33. Module Special Applications © N. Ganean, Ph.D.

34. Opening Ports for Special Applications There are special applications that would require one or more ports to be opened through the firewall/switch Examples include Internet chat, telephony applications etc.

36. Module Filters © N. Ganesan, Ph.D.

37. Filters and Blockers IP Filters –LAN clients can be selectively blocked from accessing the Internet based on their IP address MAC Filters –The same as above, but the filter is based on MAC address of a client URL Blocking –URLs can be blocked from being accessed Domain Blocking –Access to domains can be blocked as well

39. IP Filters IP filters can be applied altogether to a client or they can be applied to specific ports of a client A range of IP addresses and a range of port numbers can be specified to be filtered

40. IP range can be specified. A range of ports can be specified.

42. Module Firewall Rules © N. Ganesan, Ph.D.

43. Firewall Rules Firewall rules can be specified to allow or block traffic entering the firewall or passing through the firewall/switch For example, pinking the firewall from the Internet (WAN) side can be disabled using firewall rules

45. Module Creating Demilitarized Zones (DMZ) © N. Ganesan, Ph.D.

46. DMZ Defined Computers in the DMZ by pass the control of the firewall –In other words, for all practical purposes, they could be considered as being directly connected to the Internet

48. Module Firewall Tools © N. Ganesan, Ph.D.

49. Tools Administrative –Set passwords and enable or disable remote management Time –Set the current time and date System –Store and load firewall settings Firmware upgrade Miscellaneous tools

50. Administrative Tools Set administrator and a user password Enable the firewall to be managed from a remote computer probably over the Internet –In general, it is not desirable to enable this option for security reasons

51. 1 2 3

52. Module Set Time © N. Ganesan, Ph.D.

54. System Store current firewall settings to the hard drive Load a previously stored firewall settings from the hard drive Restore factory default settings for the firewall

55. 1 2 3

56. Module Firmware Upgrade © N. Ganesan, Ph.D.

59. Module Miscellaneous Tools © N. Ganesan, Ph.D.

60. Miscellaneous Tools Pinging a host name or an IP address Restarting the firewall –Probably to activate any changes made Block the pinging of the firewall from the Internet (WAN) side Enabling UPNP and gaming mode Allow VPN traffic based on PPTP and IPSec to pass through Enable dynamic DNS service

61. Ping Test

63. Block Pinging from the Internet Side

65. Enabling UPNP Settings and Game Mode

67. Allowing Virtual Private Networks (VPN) Connections

68. VPN Connections Firewall can be set to allow VPN links to the clients on the LAN side for the two popular protocols used in implementing VPNs

70. Module Status Reporting © N. Ganesan, Ph.D.

71. Status Reporting Display LAN and WAN settings Log and display the log of activities –Attacks, dropped packets etc. Display traffic statistics –Number of packets transmitted and received on the WAN (Internet – External) and LAN (Internal) side

72. Display of WAN and LAN Settings

74. Log of Activities

75. System activity Debug information Attacks Dropped packets Notice Note: The log can also be transmitted to an administrators email

80. Traffic Statistics

82. Additional Help

84. The End