ZyXEL Communications P-660HN-T1H User Manual
P-660HN-T1H User’s Guide
149
C
H A P T E R
1 0
Firewall
10.1 Overview
This chapter shows you how to enable the ZyXEL Device firewall. Use the firewall
to protect your ZyXEL Device and network from attacks by hackers on the Internet
and control access to it. By default the firewall:
to protect your ZyXEL Device and network from attacks by hackers on the Internet
and control access to it. By default the firewall:
• allows traffic that originates from your LAN computers to go to all other
networks.
• blocks traffic that originates on other networks from going to the LAN.
• blocks SYN and port scanner attacks.
• blocks SYN and port scanner attacks.
By default, the ZyXEL Device blocks DDOS, LAND and Ping of Death attacks
whether the firewall is enabled or disabled.
whether the firewall is enabled or disabled.
10.1.1 What You Can Do in the Firewall Screens
Use the Firewall screen (
) to enable firewall and/or SPI
on the ZyXEL Device.
10.1.2 What You Need to Know About Firewall
SYN Attack
A SYN attack floods a targeted system with a series of SYN packets. Each packet
causes the targeted system to issue a SYN-ACK response. While the targeted
system waits for the ACK that follows the SYN-ACK, it queues up all outstanding
SYN-ACK responses on a backlog queue. SYN-ACKs are moved off the queue only
when an ACK comes back or when an internal timer terminates the three-way
handshake. Once the queue is full, the system will ignore all incoming SYN
requests, making the system unavailable for legitimate users.
causes the targeted system to issue a SYN-ACK response. While the targeted
system waits for the ACK that follows the SYN-ACK, it queues up all outstanding
SYN-ACK responses on a backlog queue. SYN-ACKs are moved off the queue only
when an ACK comes back or when an internal timer terminates the three-way
handshake. Once the queue is full, the system will ignore all incoming SYN
requests, making the system unavailable for legitimate users.
DoS
Denials of Service (DoS) attacks are aimed at devices and networks with a
connection to the Internet. Their goal is not to steal information, but to disable a
connection to the Internet. Their goal is not to steal information, but to disable a