Справочник Пользователя для Netopia ISDN Router

If the package does not match the first inspector’s criteria, it goes to the second inspector, and so on. You can 
see that the order of the inspectors in the line is ver y impor tant.

For example, let’s say the first inspector’s orders are to send along all packages that come from Rome, and the 
second inspector’s orders are to reject all packages that come from France. If a package arrives from Rome, 
the first inspector sends it along without allowing the second inspector to see it. A package from Paris is 
ignored by the first inspector, rejected by the second inspector, and never seen by the others. A package from 
London is ignored by the first two inspectors, and so it’s seen by the third inspector.

In the same way, filter sets apply their filters in a par ticular order. The first filter applied can pass or discard a 
packet before that packet ever reaches any of the other filters. If the first filter can neither pass nor discard the 
packet (because it cannot match any criteria), the second filter has a chance to pass or reject it, and so on. 
Because of this hierarchical structure, each filter is said to have a priority. The first filter has the highest priority, 
and the last filter has the lowest priority.

As described above, a filter applies criteria to an IP packet and then takes one of three actions:

■

Passes the packet to the local or remote network

■

Blocks (discards) the packet

■

Ignores the packet

A filter passes or blocks a packet only if it finds a match after applying its criteria. When no match occurs, the 
filter ignores the packet.

The criteria are based on information contained in the packets. A filter is simply a rule that prescribes cer tain 
actions based on cer tain conditions. For example, the following rule qualifies as a filter:

Block all Telnet attempts that originate from the remote host 199.211.211.17.

This rule applies to Telnet packets that come from a host with the IP address 199.211.211.17. If a match 
occurs, the packet is blocked.

Here is what this rule looks like when implemented as a filter on the Netopia R310:

To understand this par ticular filter, look at the par ts of a filter.

  +-#--Source IP Addr--Dest IP Addr-----Proto-Src.Port-D.Port--On?-Fwd-+
  +--------------------------------------------------------------------+
  | 1  199.211.211.17  0.0.0.0          TCP      0      23     Yes No  |
  +--------------------------------------------------------------------+