This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
advanced-firewall [2022/01/21 01:55] – Added NAT loopback options, grammar hogwild | advanced-firewall [2022/01/21 02:49] – old revision restored (2022/01/21 02:45) hogwild | ||
---|---|---|---|
Line 3: | Line 3: | ||
The Firewall page allows you to configure options to protect/ | The Firewall page allows you to configure options to protect/ | ||
- | {{: | + | {{: |
- | + | ||
- | **WAN interfaces respond to ping and traceroute** - When enabled, this allows your device will reply to certain ICMP/UDP packets so that //ping //and // | + | |
**Limit communication to **- Specifies the maximum number of requests per second to which the Firewall will reply. Setting a limit number is recommended to prevent DDoS attacks.\\ | **Limit communication to **- Specifies the maximum number of requests per second to which the Firewall will reply. Setting a limit number is recommended to prevent DDoS attacks.\\ | ||
Line 11: | Line 9: | ||
\\ | \\ | ||
- | {{: | + | {{: |
- | **Enable TCP SYN cookies** - Enabling this protects the router from SYN Flood attacks via a well-known technique called "SYN cookies" | + | **Enable TCP SYN cookies** - Enabling this protects the router from SYN Flood attacks via a well-known technique called "SYN cookies" |
**Enable DCSP Fix** - This enables a workaround for a well-known issue related to DSCP (packet marking) when connected to the Comcast ISP. | **Enable DCSP Fix** - This enables a workaround for a well-known issue related to DSCP (packet marking) when connected to the Comcast ISP. | ||
- | **IPv6 IPSec Passthrough** - FIXME\\ | + | **IPv6 IPSec Passthrough** - FIXME\\ \\ |
+ | |||
+ | \\ | ||
{{: | {{: | ||
- | **NAT loopback** - also known as " | + | **NAT loopback** - also known as " |
* All | * All | ||
Line 27: | Line 27: | ||
* Disabled | * Disabled | ||
- | **NAT target** - Defines the way NAT is implemented for the sake of Hairpinning. Masquerade is the default however this involves an additional lookup ad the mapping of done towards an interface. SNAT is faster | + | **NAT target** - Defines the way NAT is implemented for the sake of Hairpinning. Masquerade is the default, however this involves an additional lookup ad the mapping of done towards an interface. SNAT is minimally minutely |
+ | |||
+ | \\ | ||
+ | |||
+ | Multicast\\ {{: | ||
+ | |||
+ | **Enable IGMP proxy** - Runs the IGMP (Internet Group Management Protocol) for your router.\\ | ||
+ | |||
+ | \\ | ||
+ | |||
+ | {{: | ||
+ | |||
+ | **Enable Udpxy** - Like IGMP proxy, Udpxy allows multicast communications between senders and receivers in different VLANs. Since their behavior is almost identical, it is recommended you use either Udpxy or IGMP proxy, but not both at the same time. | ||
+ | |||
+ | **Upstream interface** - Defines where the stream source is expected to live. (Default: blank). | ||
+ | |||
+ | **LAN0/ | ||
+ | |||
+ | **Enable client statistics** - Enabling this causes FreshTomato to collect statistical information about Udpxy clients. | ||
- | Multicast\\ | + | **Max clients |
- | {{: | + | **Udpxy port**- This is where you can consult the Udpxy information on your router.\\ |
- | {{: | + | {{: |
**Efficient Multicast Forwarding (IGMP Snooping) -** IGMP snooping is a way to have the switch (router) facilitating the discovery of multicast (IGMP) clients. Beware that enabling IGMP snooping might interfere with some multicast-based applications/ | **Efficient Multicast Forwarding (IGMP Snooping) -** IGMP snooping is a way to have the switch (router) facilitating the discovery of multicast (IGMP) clients. Beware that enabling IGMP snooping might interfere with some multicast-based applications/ |