User`s manual

P-660 Series Support Notes

How does ZyXEL filter work?

Filter Structure

The P-660 allows you to configure up to twelve filter sets with six rules in each set,

for a total of 72 filter rules in the system. You can apply up to four filter sets to a

particular port to block multiple types of packets. With each filter set having up to six

rules, you can have a maximum of 24 rules active for a single port. The following

diagram illustrates the logic flow when executing a filter rule.

Filter Types and SUA

Conceptually, there are two categories of filter rules: device and protocol. The

Generic filter rules belong to the device category; they act on the raw data from/to

LAN and WAN. The IP and IPX filter rules belong to the protocol category; they act

on the IP and IPX packets.

In order to allow users to specify the local network IP address and port number in the

filter rules with SUA connections, the TCP/IP filter function has to be executed before

SUA for WAN outgoing packets and after the SUA for WAN incoming IP packets.