Configuring Advanced Networking Features

You can configure the Smoothwall to block and ignore the following types of traffic:



ICMP ping broadcast — Internet Control Message Protocol (ICMP) ping broadcasts are used to determine to determine the status of network devices. It can be used as a denial of service (DoS) attack.

Select this option to prevent the Smoothwall from responding to ping broadcast messages from all network zones, including external zones.



ICMP ping

Select this option to block all ICMP ping requests going to the Smoothwall.

This effectively hides the Smoothwall from ICMP pings, but can also make connectivity problems harder to diagnose.



ICMP timestamps

Select this option to block all ICMP timestamp requests going to the Smoothwall.



IGMP packets — Internet Group Management Protocol (IGMP) is used to establish multicast group membership. Typically, IGMP packets are harmless, and are most commonly observed when using cable modems to provide external connectivity.

Select this option to ignore all IGMP packets without generating log entries.



Multicast traffic

Select this option to block all multicast traffic on address 224.0.0.0 from ISPs, and prevent them from generating large volumes of spurious log entries.



SYN+FIN packets — Typically SYN and FIN scans generate large numbers of log entries.

Select this option to automatically discard packets used in SYN+FIN scans.

You can enable the following networking features in the Smoothwall:



SYN cookies — The use of SYN cookies is a standard defence mechanism against a SYN flood attack, where a large number of SYN packets (connection requests) are sent to a machine as a DoS attack.

Select this option to defend against SYN flood attacks.



TCP timestamps (RFC1323)

Select this option to enable TCP timestamps to improve TCP performance in high speed links.



Selective ACKs (RFC2018)

Select this option to enable selective ACKs (acknowledgements) to improve TCP performance in links where packet loss is high.



Window scaling

Select this option to enable TCP window scaling to improve TCP performance in high speed links.



ECN — Explicit Congestion Notification (ECN) is a mechanism for avoiding network congestion. While effective, ECN requires communicating hosts to support it and some routers are known to drop packets marked with the ECN bit. For this reason, this feature is disabled by default.

Select this option to enable ECN.



ARP filter — The Address Resolution Protocol (ARP) filter filters out ARP flux.

Select this option to enable the ARP filter.

You can change the maximum number of remembered hosts in the ARP table if the number of directly connected machines, or IP addresses, is more then the value shown in the drop-down box.

Directly connected machines are those which are not behind a intermediate router but are instead directly attached to one of the Smoothwall's network interfaces.

Typically, the default value of 2048 is adequate, but in very big networks, select a bigger value.

Valid table sizes are:



1024



2048



4096



8192



16384

You can change the maximum number of requests in a queue, waiting to be answered. Increasing the value may reduce connection problems for an extremely busy proxy service.

Valid queue sizes are:



1024



2048



4096



8192



16384



32768



65536

You can choose to create verbose traffic logs for the purpose of analyzing incoming, outgoing, and forwarded traffic:



Direct incoming traffic

Select to logs all new connections to all interfaces that are destined for the firewall.



Forwarded traffic

Select to log all new connections passing through one interface to another.



Direct outgoing traffic

Select to log all new connections from any interface.

Note: Typically, traffic auditing generates large amounts of data. You must ensure there is sufficient disk space in the Smoothwall before enabling this — see Managing Datastore Log Retention.

You can view traffic audit logs from Reports > Logs > Firewall — see Viewing Firewall Logs.

Network application helpers enable specified traffic to pass through the firewall correctly.

It is recommended you enable the relevant network application helper if you use any of the following protocols:



FTP — IP information is embedded within File Transfer Protocol (FTP) traffic. This application helper ensures that FTP active mode client connections are not adversely affected by the firewall.



H.323 — This application helper enables pass-through of H.323 traffic, a common protocol used in voice over IP (VoIP) applications. It is also possible to receive incoming H.323 calls through the use of a port forward on the H.323 port.

This option is disabled by default because of a theoretical security risk associated with the use of H323 passthrough. It is recommended you only enable this feature if you require VoIP functionality.



IRC — IP information is embedded within Internet Relay Chat (IRC) traffic. This application helper ensures that IRC communication is not adversely affected by the firewall.



Advanced PPTP client support — This application helper enables Point-to-Point Tunneling protocol (PPTP) client traffic. This is the protocol used in standard Windows VPNs.

When disabled, it is still possible for PPTP clients to connect through to a server on the outside, but not in all circumstances. Difficulties can occur if multiple clients on the local network wish to connect to the same PPTP server on the Internet. In this case, this application helper should be used.

When enabled, it is not possible to forward PPTP traffic. For this reason, this option is not enabled by default.



SIP — IP information is embedded within Session Initiation Protocol (SIP) traffic. This application helper ensures that SIP communications are not adversely affected by the firewall.

Bad external traffic, such as those being address to ports but without any content, is rejected and a “No one here” ICMP message bounced back to the sender.

You can choose to do the following to bad external traffic:



Reject — The Smoothwall notifies the sender when bad external traffic is rejected.



Drop — The Smoothwall silently drops bad external traffic, enabling you to “stealth” your firewall, making port scans, and so on, much harder to do.