IS200DAMBG1A处理器模块,工控模块
并在此字段中输入流量阈值。值范围：10~10000。端口扫描缺陷1。所需设置2。默认情况下未选中3。流量阈值默认设置为200 4。值范围可以从10到10000。单击启用框以激活此入侵预防规则，并在此字段中输入流量阈值。值范围：10~10000。阻止陆地攻击默认情况下未选中单击启用框以激活这些入侵防御规则。阻止Ping死亡阻止IP欺骗阻止TCP标志扫描EW200工业蜂窝网关271阻止Smurf阻止跟踪路由阻止脆弱攻击ARP欺骗防御1。所需设置2。默认情况下未选中3。流量阈值默认设置为300 4。值范围可以从10到10000。单击启用框以激活此入侵预防规则，并在此字段中输入流量阈值。值范围：10~10000。保存NA单击保存以保存设置撤消NA单击撤消以取消设置EW200 Industrial Cellular Gateway 272 5.2.5选项此页面中有一些其他有用的防火墙选项。“隐身模式”允许网关对来自WAN的端口扫描作出响应，从而使其不易受到互联网上的发现和攻击SPI”使网关能够在数据包通过网关时记录数据包信息，如IP地址、端口地址、ACK、序列号等，网关检查每个传入的数据包以检测数据包是否有效。“放弃WAN Ping”使WAN侧的任何主机都无法Ping此网关。最后，“远程管理员主机”使您能够从远程主机执行管理任务。如果启用此功能，则只有指定的IP地址才能执行远程管理。EW200工业蜂窝网关273启用SPI方案如图所示，网关的IP地址为118.18.81.200（WAN接口）和192.168.1.253（LAN接口）。它充当NAT网关。网络A中的用户通过网关启动对云服务器的访问。有时，匿名用户会模拟数据包，但使用不同的源IP伪装。在网关上启用SPI功能后，它将阻止来自未知用户的此类数据包。放弃WAN Ping和远程管理员主机方案“放弃WAN Ping”使WAN侧的任何主机都无法Ping此网关并接收ICMP数据包回复。启用“放弃WAN Ping”功能，以防止本地用户使用internet时发生安全泄漏。如果远程管理员知道网关的全局IP，他/她可以通过TCP端口8080访问网关GUI。EW200工业蜂窝网关274防火墙选项设置转到安全>防火墙>选项选项卡。防火墙选项设置允许网络管理员修改防火墙的行为并启用远程路由器访问控制。启用防火墙选项防火墙选项项
this intrusion prevention rule and enter the traffic threshold in this field. Value Range: 10 ~ 10000. Port Scan Defection 1. Required setting 2. Unchecked by default 3. Traffic threshold is set to 200 by default 4. The value range can be from 10 to 10000. Click Enable box to activate this intrusion prevention rule and enter the traffic threshold in this field. Value Range: 10 ~ 10000. Block Land Attack Unchecked by default Click Enable box to activate these intrusion prevention rules. Block Ping of Death Block IP Spoof Block TCP Flag Scan EW200 Industrial Cellular Gateway 271 Block Smurf Block Traceroute Block Fraggle Attack ARP Spoofing Defence 1. Required setting 2. Unchecked by default 3. Traffic threshold is set to 300 by default 4. The value range can be from 10 to 10000. Click Enable box to activate this intrusion prevention rule and enter the traffic threshold in this field. Value Range: 10 ~ 10000. Save NA Click Save to save the settings Undo NA Click Undo to cancel the settings EW200 Industrial Cellular Gateway 272 5.2.5 Options There are some additional useful firewall options in this page. “Stealth Mode” lets the gateway t respond to port scans from the WAN so that makes it less susceptible to discovery and attacks on the Internet. ”SPI” enables the gateway to record the packet information like IP address, port address, ACK, SEQ number and so on while they pass through the gateway, and the gateway checks every incoming packet to detect if the packet is valid. “Discard Ping from WAN” makes any host on the WAN side unable to ping this gateway. And finally, “Remote Administrator Hosts” enables you to perform administration tasksfrom a remote host. If this feature is enabled, only specified IP address(es) can perform remote administration. EW200 Industrial Cellular Gateway 273 Enable SPI Scenario As shown in the diagram, the Gateway has the IP address of 118.18.81.200 for WAN interface and 192.168.1.253 for LAN interface. It serves as a NAT gateway. Users in Network-A initiate access to cloud server through the gateway. Sometimes, unkwn users will simulate the packets but use different source IP to masquerade. With the SPI feature been enabled at the gateway, it will block such packets from unkwn users. Discard Ping from WAN & Remote Administrator Hosts Scenario “Discard Ping from WAN” makes any host on the WAN side unable to ping this gateway and receive ICMP packet reply. Enable the Discard Ping from WAN function to prevent security leaks when local users use the internet. If the remote administrator kws the gateway’s global IP, he/she can access the Gateway GUI via TCP port 8080. EW200 Industrial Cellular Gateway 274 Firewall Options Setting Go to Security > Firewall > Options Tab. The firewall options setting allows network administrator to modify the behavior of the firewall and to enable Remote Router Access Control. Enable Firewall Options Firewall Options Item
