Firewall (and suchlike) on DLINK DSL 604+

Hi all,

Anyone know anything about the firewall on the DLINK DSL 604+ router ?

The sales pitch claims its an SPI firewall, which is great,
but the web setup for this is abysmal, and all the dox I have
been able to find for the command line telnet interface
are lousy.

Its a shame, its a nice piece of kit, and it works really well,
but I really want to tweak it.

Any pointers much appreciated

I've got a 504 and the doc is appalling.
I called dlink and they said it blocks all incoming on a port unless you
have done a outgoing.
That's all I got out of them.

Paul


"lensman" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
>
> Hi all,
>
> Anyone know anything about the firewall on the DLINK DSL 604+ router ?
>
> The sales pitch claims its an SPI firewall, which is great,
> but the web setup for this is abysmal, and all the dox I have
> been able to find for the command line telnet interface
> are lousy.
>
> Its a shame, its a nice piece of kit, and it works really well,
> but I really want to tweak it.
>
> Any pointers much appreciated
>

Have you seen Dea's post? if not......


Hiya John,
I use a dlink 504 also, but with NAT, however I work with firewall
policy so I'll give it a go for ya!

Are you using PPPoE or PPPoA ? I would be thinking PPPoA would be more
likely in the UK (PPPoE more common here in AU)
Do you have a gateway IP set for the router WAN port? I'll assume you
have, and ip forwarding is configured and working (ie everything is
working without the firewall stuff enabled)

Also, I believe the rule order is important to the dlink firewall (as
it is in most commercial enterprise products), and as such the end
rule should look (in its simplest notation) as 'any traffic from and
to anywhere, on any protocol, DROP!'

(example follows)
So, lets assume you wanted to disable IRC from inside your network.
we will also assume that your IP allocation is sequenced (say,
203.10.0.1, 203.10.0.2, 203.10.0.3, 203.10.0.4) Your router is usually
assigned one of your static IP numbers, unless your ISP has something
else organised.

IP Filter state : enabled
if not matched : pass
name : block_irc


pass or block? block
direction is always in, on my firmware (R2.21.002.05.b13au)
Protocol : TCP
Source : (the outside world)
IP : leave on 0.0.0.0 (you could indicate a specific server IP here)
Subnet mask: 0.0.0.0/0 (defaults seem okay on dlinks!)
greater than/equals/less than symbols : shouldnt matter
start port: 0
end port : 0
(Im not informed regarding current irc service ports, so these are
general)

Destination : (your internal network)
IP : 203.10.0.0 (specify the c class for brevity)
subnet mask : 255.255.255.0/24
greater than/equals/less than symbols : 'select greater than'
start port : 6666
end port : 6669

then add it and test it.
Its a bit easier to specify the c-class address (203.10.0.0) as the
dlink firewall wont allow several, specific or multinetwork IPs to be
used in part of a ruleset.

So, this router will basically let everything in and out, except it
wont let anyone on 203.10.0.xx connect to IRC servers.

My apologies if this is offtrack to what you were seeking - if it is,
perhaps you need to find a different way of explaining the problem?

If you cant connect to websites etc via the router with the firewall
module disabled, then it would seem you have a routing or possibly a
connection issue.

Anyways, 4am for me, off to bed!

cheerio

Dea



"Paul C" <(E-Mail Removed)> wrote in message
news:3f926d9d$0$246$(E-Mail Removed).. .
> I've got a 504 and the doc is appalling.
> I called dlink and they said it blocks all incoming on a port unless you
> have done a outgoing.
> That's all I got out of them.
>
> Paul
>
>
> "lensman" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> >
> > Hi all,
> >
> > Anyone know anything about the firewall on the DLINK DSL 604+ router ?
> >
> > The sales pitch claims its an SPI firewall, which is great,
> > but the web setup for this is abysmal, and all the dox I have
> > been able to find for the command line telnet interface
> > are lousy.
> >
> > Its a shame, its a nice piece of kit, and it works really well,
> > but I really want to tweak it.
> >
> > Any pointers much appreciated
> >
>
>

On Mon, 20 Oct 2003 21:28:09 +0100, in uk.telecom.broadband Paul C
mumbled thusly.... :

>Have you seen Dea's post? if not......

<snip>

Not exactly what I;m after, but v helpful info all the same

Cheers ;-)

On Fri, 17 Oct 2003 15:14:44 +0000 (UTC), in uk.telecom.broadband
lensman mumbled thusly.... :

>
>Hi all,
>
>Anyone know anything about the firewall on the DLINK DSL 604+ router ?
>
>The sales pitch claims its an SPI firewall, which is great,
>but the web setup for this is abysmal, and all the dox I have
>been able to find for the command line telnet interface
>are lousy.
>
>Its a shame, its a nice piece of kit, and it works really well,
>but I really want to tweak it.
>
>Any pointers much appreciated


Ah ha!

http://www.e-tech.nu/support/adsl_fi...nexbtelnet.doc

A proper ATMOS command manual, this should do the trick