Netopia r3100-u Verweisanleitung

and a packet goes through these rules destined for FTP, the packet would pass through the first filter rule 
(WWW), match the second rule (FTP) and the packet is allowed through. Even though the next rule is to deny all 
FTP traffic, the FTP packet will never make it to this rule.

It is easiest when doing filtering to conver t the IP address and mask in question to binar y. This will allow you to 
per form the logical AND to determine if a packet matches a filter rule.

When a packet is compared (in most cases) a logical AND is per formed. First the IP addresses and subnet 
masks are conver ted to binar y and then ANDed together. The rules for logical ANDing are as follows:

0 AND 0 = 0

0 AND 1 = 0

1 AND 0 = 0

1 AND 1 = 1

For example:

Filter rule:

Deny

IP: 163.176.1.15

BINARY: 10100011.10110000.00000001.00001111

Mask: 255.255.255.255

BINARY: 11111111.11111111.11111111.11111111

Incoming Packet:

IP 163.176.1.15

BINARY: 10100011.10110000.00000001.00001111

AND the incoming packet and subnet mask together, the result is:

10100011.10110000.00000001.00001111

which matches the IP address in the filter rule and the packet is denied.

With a given set of filter rules, there is an Implied rule which may or may not be shown to the user. The implied 
rule tells the filter set what to do with a packet that does not match any of the filter rules. An example of implied 
rules is as follows:

Implied

Meaning

Y+Y+Y=N

If all filter rules are YES, the implied is NO.

N+N+N=Y

If all filter rules are NO, the implied is YES.

Y+N+Y=N

If a mix of YES and NO filters, the implied is NO.