ZyXEL 2WG Guida Utente

Chapter 41 Filter Configuration

ZyWALL 2WG User’s Guide

After you’ve created the filter set, you must apply it. 

1 Enter 11 from the main menu to go to menu 11.
2 Enter 1 or 2 to open Menu 11.x - Remote Node Profile.
3 Go to the Edit Filter Sets field, press [SPACE BAR] to select Yes and press [ENTER].
4 This brings you to menu 11.1.4.  Apply a filter set (our example filter set 3) as shown in 

5 Press [ENTER] to confirm after you enter the set numbers and to leave menu 11.1.4.

There are two classes of filter rules, Generic Filter (Device) rules and protocol filter (TCP/
IP) rules. Generic filter rules act on the raw data from/to LAN and WAN. Protocol filter rules 
act on the IP packets. Generic and TCP/IP filter rules are discussed in more detail in the next 
section. When NAT  (Network Address Translation) is enabled, the inside IP address and port 
number are replaced on a connection-by-connection basis, which makes it impossible to know 
the exact address and port on the wire. Therefore, the ZyWALL applies the protocol filters to 
the “native” IP address and port number before NAT for outgoing packets and after NAT for 
incoming packets. On the other hand, the generic, or device filters are applied to the raw 
packets that appear on the wire. They are applied at the point when the ZyWALL is receiving 
and sending the packets; i.e. the interface. The interface can be an Ethernet port or any other 
hardware port. The following diagram illustrates this.

Figure 412   Protocol and Device Filter Sets

Below are some comparisons between the ZyWALL’s filtering and firewall functions.

• The router filters packets as they pass through the router’s interface according to the filter 

rules you designed.

• Packet filtering is a powerful tool, yet can be complex to configure and maintain, 

especially if you need a chain of rules to filter a service.

• Packet filtering only checks the header portion of an IP packet.