3Com HomeConnect 3CP3647 Cli User's Manual

Also see for HomeConnect 3CP3647: Installation guide

Contents

4-6 CHAPTER 4: FILTERING CAPABILITIESn Interfacesn PortsInterface Filters You can configure interface filters for any interface. Interface filters control accessto all networks available for both modem and non-modem interfaces. You canspecify whether a filter applies to packets entering the interface (input filter) orleaving the interface (output filter). The bridge examines the filtering rules todetermine whether the interface accepts or rejects the packet.Input Filter If an input filter is configured on an interface, all packets received into the bridgein that interface are checked against the filtering rules before being forwarded toanother interface.Output Filters If an output filter is configured on an interface, all packets received into the bridgeon that interface are checked against the filtering rules before exiting the bridge.Input Filters vs. OutputFiltersWhen possible, use the input filter to filter an incoming packet rather than waitingto catch a packet as it attempts to exit the bridge. This is recommended because:n A packet is prevented from entering the bridge, keeping potential intrudersfrom attacking the unit itself.n The bridging engine does not waste time processing a packet that is going tobe discarded anyway.n Most importantly, the bridge does not know which interface an outgoingpacket came in through. If a potential intruder forges a packet with a falsesource address (in order to appear as a trusted host or network), there is noway for an output filter to tell if that packet came in through the wronginterface. An input filter, on the other hand, can filter out packets purportingto be from networks that are actually connected to a different interface.Port Filters You can configure filters for a specific port profile that controls access to thenetwork for that location. This filter is only applied for the duration of the remotenetwork connection. As with interface filters, a port filter can be configured toapply to input or output data traffic.Applying Filters You can apply filters to interfaces and/or ports using the CLI. If you modify a file,you need to re-apply it to make the changes take effect immediately. Otherwisethe changes will not take effect until the bridge network that the filter affectsgoes down and comes back up. This occurs when a network is disabled, the WANconnection goes down then up, or when the 3Com HomeConnect ADSL ModemEthernet is rebooted.Apply a Filter to anInterfaceTo configure an input or output filter on an interface, use the following CLIcommands:set interface input_filter set interface output_filter