NOTE:
Opening holes in your firewall can compromise your LAN's security
if done incorrectly.
With the basics out of the way, let's take a look at the real
reason that you'd buy the 312... its Firewall. But
we also run into the first obstacle:
You can only
configure the Firewall features via the PNC Firewall Setup application.
This means that you'll need a computer running Windows 95, 98,
or NT4 to do anything besides enable and disable the Firewall
(which you can do through the SMT (Telnet) interface).
Assuming you have the proper computer available, you use the
PNC Firewall app to:
-
Enable / Disable the firewall
-
Setup emailing of firewall alerts
-
Set timing thresholds for Alert features
-
Configure policies
-
View Firewall logs
The screenshots below show some of the Firewall setup features.
I tested the firewall by port scanning it and by trying to connect
with applications that I had set policies to block. The
312 properly blocked the traffic and sent an email alert, with
my LAN clients none the worse for the attack. I also tried
a ping flood with similar results. Looks like it works!
There are some nice Firewall features that I didn't try, such
as the ability to set timeouts on various TCP, UDP and ICMP connection
types, and the ability to define customs services (for use in
Policy rules) that include port ranges.
On the downside, however, you can't define custom services using
the ICMP protocol, and the logging could be better (more on that
later).
The main thing that I found confusing about this part of the
312's capabilities is the relationship (overlap?) between the
Filter and Firewall capabilities. Although page 12-7 of
the User Guide gives a good explanation of when to use the Filter
and Firewall features, I found it easy to be confused. When
I compare ZyXEL's approach to that used by SonicWall, I definitely
prefer SonicWall's approach, in which Filtering applies more to
content vs. packets/ports. I also found it a pain
to have to keep switching between the SMT (Telnet), Advanced Setup
PNC, and Firewall PNC, to configure the 312, and especially to
debug my setup problems. (This is due to the limitation
of only one admin login at a time.) For example, it
took me some hunting between the Advanced and Firewall PNCs to
track down the way to shut off a Policy that was logging all LAN
to WAN traffic and causing constant email Alerts to be sent.
Filter configuration is possible without using
the PNC application, but you'll probably prefer using the PNC.
The PNC screens and the browser based help pages that can be brought
up via a Help button on each screen should help many users successfully
set up this important part of the router's capabilities.
|
