Firewall configuration object. The {{param|Config}} parameter enables and disables the Firewall, and can select either a predefined configuration ({{enum|High|Config}} or {{enum|Low|Config}}) or an explicitly-defined {{enum|Advanced|Config}} configuration. For an {{enum|Advanced|Config}} configuration, {{param|AdvancedLevel}} controls the currently active Firewall Level, and the Firewall Levels are defined in the {{object|Level}}, {{object|Chain}} and {{object|Chain.{i}.Rule}} tables. For an {{enum|Policy|Config}} configuration, {{param|PolicyLevel}} controls the currently active Firewall Level, and the Firewall Levels are defined in the {{object|Policy}}, {{object|Level}}, {{object|Chain}} and {{object|Chain.{i}.Rule}} tables. The Firewall rules modeled by {{object|Chain}}, {{object|DMZ}} and {{object|Pinhole}} operate only on the forwarding path. This means that they affect only routed traffic, and do not affect traffic that is destined for or generated by the device itself. Traffic destined for or generated by the device itself can use the {{object|Service}} object to model the appropriate Firewall rules. Note that any {{object|#.NAT}} processing on the ingress packet occurs before Firewall rules are applied so, for example, the Firewall rules will see the translated destination IP address and port in a downstream packet that has passed through the NAT. See {{bibref|TR-181i2|Appendix VIII}} for an example {{enum|Advanced|Config}} configuration. Enables or disables the Firewall. Firewalls often implement additional Denial of Service and other vulnerability protections, such as those described in {{bibref|ICSA-Baseline}}. If a {{enum|Stateful|Type}} Firewall is enabled, then it is assumed that all implemented stateful protections are enabled, unless they are overridden by some other part of the data model. How this firewall is configured. {{enum}} Vendors can extend the enumerated values with vendor specific extensions, in which case the rules outlined in {{bibref|TR-106|Section 3.3}} MUST be adhered to. The firewall implements the "Traffic Denied Inbound" and "Minimally Permit Common Services Outbound" components of the ICSA residential certification's Required Services Security Policy {{bibref|ICSA-Residential}}. If DoS and vulnerability protections are implemented {{bibref|ICSA-Baseline}}, these are enabled. All Outbound traffic and pinhole-defined Inbound traffic is allowed. If DoS and vulnerability protections are implemented {{bibref|ICSA-Baseline}}, these are enabled. All Inbound and Outbound traffic is allowed, and the CPE is only protected by NAT settings (if supported and enabled). If DoS and vulnerability protections are implemented {{bibref|ICSA-Baseline}}, these are disabled. {{obsoleted|2.14|because it is the same as setting {{param|Enable}} to {{false}}}} {{deleted|2.16}} Advanced firewall configuration applies, as specified by {{param|AdvancedLevel}}. Policy firewall configuration applies, as specified by {{param|PolicyLevel}}. Selects the currently active Firewall Level. {{param}} only applies when {{param|Config}} is {{enum|Advanced|Config}}. Selects the currently active Firewall Policy Level. {{param}} only applies when {{param|Config}} is {{enum|Policy|Config}}. Firewall Type. {{enum}} A {{enum|Stateless}} Firewall treats each packet individually and thus has no concept of sessions. Therefore a {{enum|Stateless}} Firewall cannot distinguish between unsolicited downstream traffic and downstream traffic in response to outbound messages. This means that it has to accept all incoming downstream traffic. Furthermore, because a {{enum|Stateless}} Firewall treats each packet individually, it does not provide any DoS or vulnerability protections. A {{enum|Stateful}} Firewall maintains state about previous packets and thus supports sessions. Therefore a {{enum|Stateful}} Firewall can distinguish between solicited and unsolicited downstream traffic. In a {{enum|Stateful}} Firewall, explicitly configured rules only apply to unsolicited traffic, and can not cause packets received in response to an upstream request to be dropped. Furthermore, because a {{enum|Stateful}} Firewall maintains state, it can provide DoS and vulnerability protections. A device that has a {{enum|Stateless}} Firewall depends on the NAT to provide protection against unsolicited downstream IPv4 traffic. This is because, as noted above, a {{enum|Stateless}} Firewall has to be configured to accept all incoming downstream traffic. For IPv6 there is no NAT, so a {{enum|Stateless}} Firewall can not provide simple security protections against unsolicited downstream IPv6 traffic. The Firewall only implements stateless packet inspection. The Firewall implements stateful packet inspection. A string identifying the firewall settings version currently used in the CPE, or {{empty}} if the firewall settings are not associated with a version. The time at which the firewall settings most recently changed. {{numentries}} {{numentries}} {{numentries}} {{numentries}} {{numentries}} {{numentries}} {{numentries}} {{numentries}} Firewall Level table. When an {{enum|Advanced|#.Config}} or {{enum|Policy|#.Config}} configuration is selected, {{param|#.AdvancedLevel}} or {{param|#.PolicyLevel}} selects the currently active entry in this table. Each {{object}} table entry references the {{object|#.Chain}} that contains the rules for this level. Human-readable name associated with this {{object}} entry. Human-readable description associated with this {{object}} entry. {{datatype|expand}} This indicates the order of the {{object}} entry in the user interface display. Levels can be presented according to increasing or decreasing level of security. {{list}} {{reference|a {{object|#.Policy}}}} {{param}} only applies when {{param|#.Config}} is {{enum|Policy|#.Config}}. The Chain containing Firewall Level Rules associated with this {{object}} entry. On creation of a new {{object}} entry, the device will automatically create a new {{object|#.Chain}} table entry that this {{param}} parameter will reference. Indicates whether NAT port mapping is enabled or disabled when this is the active Level. For a {{enum|Stateless|#.Type}} Firewall this can be set to {{false}} to force any port mappings to be operationally disabled (for a {{enum|Stateful|#.Type}} Firewall this is not necessary because the same effect can be achieved via Firewall rules). This parameter affects all the interfaces on which NAT is enabled. It operationally enables or disables port mapping functionality and therefore does not affect the individual {{param|##.NAT.PortMapping.{i}.Enable}} settings. Note that the current NAT status and NAT port mapping status are indicated by the {{param|##.NAT.InterfaceSetting.{i}.Status}} parameter. Default action for packets not matching any of the level rules. {{enum}} The firewall discards packets matching this rule. The firewall forwards packets matching this rule. The firewall discards packets matching this rule, and sends an ICMP message to the originating host. Enable or disable logging, in a {{object|##.DeviceInfo.VendorLogFile}}, of packets not matching any of the level rules. Firewall Chain table. Each entry contains an ordered list of {{object|Rule}} objects which can themselves reference other {{object}} instances. A hierarchy of rules can therefore be created. A given Firewall Chain's rules are all created by the same entity, as indicated by the {{param|Creator}} parameter. Enables or disables this {{object}} entry. Human-readable name associated with this {{object}} entry. Creator of this {{object}} entry and of its {{object|Rule}}s. {{enum}} Note that this is the entity that originally created the {{object}} entry. The value of this parameter does not change if the {{object}} entry or one of its rules is subsequently changed by another entity. The {{object}} entry is present in the factory default configuration. The {{object}} entry was created as a side-effect of a {{bibref|UPnP-IGD:1}} or {{bibref|TR-064}} port mapping. The {{object}} entry was created by {{bibref|UPnP-IGD:2}} WANIPv6FirewallControl. The {{object}} entry was created by the Auto Configuration Server. The {{object}} entry was created by device user interface or command line interface. The {{object}} entry was created by another entity. {{numentries}} Firewall Rule table. Each entry defines a Firewall packet selection rule. The {{param|Target}} parameter defines the action to perform for traffic matching this rule: the packet can be dropped, accepted, rejected or passed to another {{object|#}}. This table MUST NOT contain dynamic Firewall rules associated with {{enum|Stateful|##.Type}} Firewall sessions. All entries are created by the creator of the parent {{object|#}}, as indicated by its {{param|#.Creator}} parameter. {{object}} entries in a {{object|#}} with a {{param|#.Creator}} of {{enum|Defaults|#.Creator}}, {{enum|ACS|#.Creator}}, {{enum|UserInterface|#.Creator}} or (maybe) {{enum|Other|#.Creator}} are referred to as ''Static'' {{object}}s. Whether or not a {{object}} in a {{object|#}} with {{param|#.Creator}} {{enum|Other|#.Creator}} is regarded as ''Static'' is a local matter to the CPE. Some of this object's parameter descriptions refer to whether a {{object}} is ''Static'' when specifying whether or not the parameter value can be modified. For enabled table entries, if {{param|SourceInterface}} is not a valid reference and {{param|SourceAllInterfaces}} is {{false}}, or if {{param|DestInterface}} is not a valid reference and {{param|DestAllInterfaces}} is {{false}}, then the table entry is inoperable and the CPE MUST set {{param|Status}} to {{enum|Error_Misconfigured|Status}}. Enables or disables this {{object}} entry. The status of this {{object}} entry. {{enum}} The {{enum|Error_Misconfigured}} value indicates that a necessary configuration value is undefined or invalid. The {{enum|Error}} value MAY be used by the CPE to indicate a locally defined error condition. {{datatype|expand}} For each packet, the highest ordered entry that matches the rule criteria is applied. All lower order entries are ignored. Human-readable description associated with this {{object}} entry. Action to perform for traffic matching this {{object}} entry. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). The firewall discards packets matching this rule. The firewall forwards packets matching this rule. The firewall discards packets matching this rule, and sends an ICMP message to the originating host. The firewall doesn't consider the remaining rules (if any) in the current chain. The rules in the chain referenced by the {{param|TargetChain}} parameter are matched. Specifies the chain to process when {{param|Target}} equals {{enum|TargetChain|Target}}. If there are no matching rules in the referenced chain, processing continues with the next rule in this chain (if any). In other words, {{enum|TargetChain|Target}} behaves like a subroutine call. {{empty}} indicates no {{param}} is specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). Enable or disable logging, in a {{object|###.DeviceInfo.VendorLogFile}}, of packets matching this {{object}}. If the {{object}} is not ''Static'' (as explained in the object description), whether changes to this parameter persist across re-boot is a local matter to the CPE. Date and time when this {{object}} entry was created. The time at which this {{object}} entry will expire, or {{null}} if not known. For an infinite lifetime, the parameter value MUST be 9999-12-31T23:59:59Z. The only value that MUST be supported is 9999-12-31T23:59:59Z (i.e. support for rules that expire is OPTIONAL). When a rule expires, the CPE MUST automatically terminate that rule and MUST automatically delete the corresponding {{object}} table entry. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. {{reference}} This specifies the ingress interface associated with the entry. It MAY be a layer 1, 2 or 3 interface, however, the types of interfaces for which Rules can be instantiated is a local matter to the CPE. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|SourceInterface}} entry, if specified. If {{true}}, the rule matches all packets except those that match the {{param|SourceInterface}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. This specifies that all ingress interfaces are associated with the entry. If {{true}}, the values of {{param|SourceInterface}} and {{param|SourceInterfaceExclude}} are ignored since all ingress interfaces are indicated. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. {{reference}} This specifies the egress interface associated with the entry. It MAY be a layer 1, 2 or 3 interface, however, the types of interfaces for which Rules can be instantiated is a local matter to the CPE. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|DestInterface}} entry, if specified. If {{true}}, the rule matches all packets except those that match the {{param|DestInterface}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. This specifies that all egress interfaces are associated with the entry. If {{true}}, the values of {{param|DestInterface}} and {{param|DestInterfaceExclude}} are ignored since all ingress interfaces are indicated. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. IP Protocol Version as specified in {{bibref|IANA-ipversionnumbers}}. For example: * ''4'' (IPv4) * ''6'' (IPv6) A value of ''-1'' indicates this criterion is not used for matching. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. Destination IP address. {{empty}} indicates this criterion is not used for matching. Note that Firewall rules are applied after any {{object|###.NAT}} processing, so if NAT is enabled on the source interface this is always the translated address. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). Destination IP address mask, represented as an IP routing prefix using CIDR notation [RFC4632]. The IP address part MUST be {{empty}} (and, if specified, MUST be ignored). If {{false}}, the rule matches only those packets that match the (masked) {{param|DestIP}} entry, if specified. If {{true}}, the rule matches all packets except those that match the (masked) {{param|DestIP}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. Destination Match Set, Matches packets if their destination is found in the designated {{object|##.Set.}} reference. {{empty}} indicates this criterion is not used for matching. {{object}} criterion. Destination Exclude Match Set, Matches packets if their destination is not found in the designated {{object|##.Set.}} reference. {{empty}} indicates this criterion is not used for matching. {{object}} criterion. Source IP address. {{empty}} indicates this criterion is not used for matching. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). Source IP address mask, represented as an IP routing prefix using CIDR notation [RFC4632]. The IP address part MUST be {{empty}} (and, if specified, MUST be ignored). If {{false}}, the rule matches only those packets that match the (masked) {{param|SourceIP}} entry, if specified. If {{true}}, the rule matches all packets except those that match the (masked) {{param|SourceIP}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. Source Match Set, Matches packets if their source is found in the designated {{object|##.Set.}} reference. {{empty}} indicates this criterion is not used for matching. {{object}} criterion. Source Exclude Match Set, Matches packets if their source is not found in the designated {{object|##.Set.}} reference. {{empty}} indicates this criterion is not used for matching. {{object}} criterion. Protocol number. A value of -1 indicates this criterion is not used for matching. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|Protocol}} entry, if specified. If {{true}}, the rule matches all packets except those that match the {{param|Protocol}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. Destination port number. A value of -1 indicates this criterion is not used for matching. Note that Firewall rules are applied after any {{object|###.NAT}} processing, so if NAT is enabled on the source interface this is always the translated port number. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. If specified, indicates the {{object}} criterion is to include the port range from {{param|DestPort}} through {{param}} (inclusive). If specified, {{param}} MUST be greater than or equal to {{param|DestPort}}. A value of -1 indicates that no port range is specified. Note that Firewall rules are applied after any {{object|###.NAT}} processing, so if NAT is enabled on the source interface this is always the translated port number. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|DestPort}} entry (or port range), if specified. If {{true}}, the rule matches all packets except those that match the {{param|DestPort}} entry (or port range), if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. Source port number. A value of -1 indicates this criterion is not used for matching. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. If specified, indicates the {{object}} criterion is to include the port range from {{param|SourcePort}} through {{param}} (inclusive). If specified, {{param}} MUST be greater than or equal to {{param|SourcePort}}. A value of -1 indicates that no port range is specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|SourcePort}} entry (or port range), if specified. If {{true}}, the rule matches all packets except those that match the {{param|SourcePort}} entry (or port range), if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). {{object}} criterion. DiffServ codepoint (defined in {{bibref|RFC2474}}). If set to a Class Selector Codepoint (defined in {{bibref|RFC2474}}), all DSCP values that match the first 3 bits will be considered a valid match. A value of -1 indicates this criterion is not used for matching. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). If {{false}}, the rule matches only those packets that match the {{param|DSCP}} entry, if specified. If {{true}}, the rule matchess all packets except those that match the {{param|DSCP}} entry, if specified. This parameter can only be modified if the {{object}} is ''Static'' (as explained in the object description). Matches only packets according to the following connection states. {{empty}} indicates this criterion is not used for matching. The received packet is not associated with an known connection and it may contain faulty data or headers. The first received packet of a new not yet established connection. The received packet that is starting a new connection and is related to an already known and established connection. The received packet is part of an already established and known connection that has handled packets in both directions and is being considered fully valid. Source MAC address. {{empty}} indicates this criterion is not used for matching. If {{false}}, the rule matches only those packets that match the {{param|SourceMAC}} entry, if specified. If {{true}}, the rule matches all packets except those that match the {{param|SourceMAC}} entry, if specified. Firewall Pinhole object that is used for configuring pinholes. Pinholes are similar to port mapping entries but without the NAT support. The Pinhole table is used for allowing certain incoming traffic, on the {{param|Interface}}, to be routed to the internal network. For enabled table entries, if {{param|DestMACAddress}} and {{param|DestIP}} are {{empty}}, or if {{param|Interface}} is not a valid reference, then the table entry is inoperable and the device MUST set {{param|Status}} to {{enum|Error_Misconfigured|Status}}. Enables or disables the pinhole. The status of this {{object}} entry. Indicates that the pinhole is disabled. Indicates that the pinhole is enabled. Indicates that the pinhole is still enabled but has been temporarily deactivated due to the Schedules defined in {{param|ScheduleRef}}. Indicates that a necessary configuration value is undefined or invalid. MAY be used to define an error condition. Indicates the Origin of the {{object}} instance. Note: This parameter was changed to writeOnceReadOnly in the Device:2.18 version. Used for indicating that the pinhole rule was created by the end-user. For example through the web user interface. Used for indicating that the pinhole rule was created by the system itself. Used for indicating that the pinhole rule was created by a device using UPnP-IGD. Used for indicating that the pinhole rule was created by a Controller. Human-readable description associated with this {{object}} entry. Specifies the incoming L3 interface to which this pinhole applies. Determines the time to live, in {{units}}, of a pin hole lease, where "time to live" means the number of {{units}} before the pin hole expires. A value of 0 means the pin hole is static. Support for dynamic (non-static) pin hole is OPTIONAL. That is, the only value for {{param}} that MUST be supported is 0. For a dynamic (non-static) pin hole, when this parameter is read, the value represents the time (in {{units}}) remaining on the pin hole lease. That is, for a dynamic pin hole, the value counts down toward 0. When a dynamic pin hole lease expires, the device MUST automatically terminate that pin hole, and MUST automatically delete the corresponding {{object}} table entry. For a static pin hole, this parameter is irrelevant and should return ''0''. Source port number of the incoming connection. A value of ''-1'' indicates this criterion is not used for matching. If specified, indicates the {{object}} criterion is to include the port range from {{param|SourcePort}} through {{param}} (inclusive). If specified, {{param}} MUST be greater than or equal to {{param|SourcePort}}. A value of -1 indicates that no port range is specified. Destination port number. A value of ''-1'' indicates this criterion is not used for matching. If specified, indicates the {{object}} criterion is to include the port range from {{param|DestPort}} through {{param}} (inclusive). If specified, {{param}} MUST be greater than or equal to {{param|DestPort}}. A value of -1 indicates that no port range is specified. IP Protocol Version as specified in {{bibref|IANA-ipversionnumbers}}. For example: * ''4'' (IPv4) * ''6'' (IPv6) A value of ''-1'' indicates this criterion is not used for matching. Protocol number as specified in {{bibref|IANA-protocolnumbers}} For example: * ''6'' (TCP) * ''17'' (UDP) A value of ''-1'' indicates this criterion is not used for matching. Only allow incoming connections that match one or more of the source IP addresses or prefixes that are specified in {{param}} for the applied pinhole. The IP address of a client on the internal network. Either {{param}} or {{param|DestMACAddress}} MUST be configured, it is not allowed to configure them both. {{empty}} indicates this criterion is not used for matching. The MAC address of a client on the internal network. Either {{param}} or {{param|DestIP}} MUST be configured, it is not allowed to configure them both. {{empty}} indicates this criterion is not used for matching. Firewall DMZ object that is be used for configuring a demilitarized zone. A DMZ network is a separate network perimeter that protects the internal network from untrusted traffic. Typically the DMZ is located between two firewalls, the firewall of the internal network and the firewall responsible for handling untrusted traffic. The device MUST forward all received packets that matches the {{param|SourcePrefix}} criteria to the IP address that is specified in {{param|DestIP}}. For enabled table entries, if {{param|DestIP}} is {{empty}}, or if {{param|Interface}} is not a valid reference, then the table entry is inoperable and the device MUST set {{param|Status}} to {{enum|Error_Misconfigured|Status}}. Enables or disables the firewall DMZ instance. The status of this {{object}} entry. Indicates that the DMZ entry is disabled. Indicates that the DMZ entry is enabled. Indicates that a necessary configuration value is undefined or invalid. MAY be used to define an error condition. Indicates who configured the {{object}} instance. Note: This parameter was changed to writeOnceReadOnly in the Device:2.18 version. Used for indicating that the DMZ rule was created by the end-user. For example through the web user interface. Used for indicating that the DMZ rule was created by the system itself. Used for indicating that the DMZ rule was created by a Controller, Human-readable description associated with the entry. This specifies the incoming L3 interface to which the DMZ applies. Determines the time to live, in {{units}}, of a DMZ rule, where "time to live" means the number of {{units}} before the DMZ rule expires. A value of 0 means the DMZ rule is static. Support for dynamic (non-static) DMZ rules is OPTIONAL. That is, the only value for {{param}} that MUST be supported is 0. For a dynamic (non-static) DMZ rule, when this parameter is read, the value represents the time (in {{units}}) remaining on the DMZ rule lease. That is, for a dynamic DMZ rule, the value counts down toward 0. When a dynamic DMZ rule lease expires, the device MUST automatically terminate that DMZ rule, and MUST automatically delete the corresponding {{object}} table entry. For a static DMZ rule, this parameter is irrelevant and should return ''0''. The IPv4 address of a client in the DMZ network. Only allow incoming connections that match to the source IPv4 address or prefix that is specified in {{param}} for the applied DMZ instance. {{empty}} indicates this criterion is not used for matching. Firewall Service object that is used for configuring the firewall for opening a port/protocol for a local network service. For example: * ''SSH Server'' * ''Web Server'' For enabled table entries, if {{param|Interface}}, {{param|DestPort}} and {{param|Protocol}} are {{empty}}, or if {{param|Interface}} is not a valid reference, then the table entry is inoperable and the device MUST set {{param|Status}} to {{enum|Error_Misconfigured|Status}}. Enables or disables the firewall service instance. The status of this {{object}} entry. Indicates that the Service entry is disabled. Indicates that the Service entry is enabled. Indicates that a necessary configuration value is undefined or invalid. MAY be used to define an error condition. This specifies the incoming L3 interface to which the Service rule applies. Destination port number. A value of ''-1'' indicates this criterion is not used for matching. IP Protocol Version as specified in {{bibref|IANA-ipversionnumbers}}. For example: * ''4'' (IPv4) * ''6'' (IPv6) A value of ''-1'' indicates this criterion is not used for matching. Protocol number as specified in {{bibref|IANA-protocolnumbers}} For example: * ''6'' (TCP) * ''17'' (UDP) A value of ''-1'' indicates this criterion is not used for matching. ICMP type as specified in {{bibref|RFC792}} for 'IPv4' and {{bibref|RFC4443}} for 'IPv6'. Only applicable when {{param|Protocol}} contains ''1'' (ICMP IPv4) or ''58'' (ICMP IPv6). A value of ''-1'' indicates this criterion is not used for matching. Only allow incoming connections that match one or more of the source IP addresses or prefixes that are specified in {{param}} for the applied service. Action to perform for traffic matching this {{object}} entry. The firewall discards packets matching this rule. The firewall forwards packets matching this rule. The firewall discards packets matching this rule, and sends an ICMP message to the originating host. Firewall Policy table. When a {{enum|Policy|#.Config}} configuration is selected, {{param|#.PolicyLevel}} selects the currently active entry in this table. Each {{object}} table entry references the {{object|#.Chain}} that contains the rules for this policy. Enables or disables the firewall policy. The status of this {{object}} entry. {{enum}} The {{enum|Error_Misconfigured}} value indicates that a necessary configuration value is undefined or invalid. The {{enum|Error}} value MAY be used by the CPE to indicate a locally defined error condition. The Chain containing Firewall Rules associated with this {{object}} entry. This is applicable for traffic from the {{param|SourceInterface}} to the {{param|DestinationInterface}}. {{param}} only applies when {{param|TargetChain}} is {{enum|Chain|TargetChain}}. Action to perform for traffic matching this {{object}} entry. {{enum}} The firewall discards packets matching this rule. The firewall forwards packets matching this rule. The firewall discards packets matching this rule, and sends an ICMP message to the originating host. The rules in the chain referenced by the {{param|Chain}} parameter are matched. This specifies the L3 source interface associated with the entry. This specifies the L3 destination interface associated with the entry. IP Protocol Version as specified in {{bibref|IANA-ipversionnumbers}}. For example: * ''4'' (IPv4) * ''6'' (IPv6) A value of ''-1'' indicates this criterion is not used for matching. The Chain containing Firewall Rules associated with this {{object}} entry. This is applicable for traffic from the {{param|DestinationInterface}} to the {{param|SourceInterface}}. {{param}} only applies when {{param|ReverseTargetChain}} is {{enum|Chain|ReverseTargetChain}}. Action to perform for traffic matching this {{object}} entry. The firewall discards packets matching this rule. The firewall forwards packets matching this rule. The firewall discards packets matching this rule, and sends an ICMP message to the originating host. The rules in the chain referenced by the {{param|ReverseChain}} parameter are matched. Firewall settings for an associated IP Interface. For enabled table entries, if {{param|Interface}} is not a valid reference then the table entry is inoperable and the device MUST set {{param|Status}} to {{enum|Error_Misconfigured|Status}}. Note: The {{object}} includes a unique key that is a strong reference. If a strongly referenced object is deleted, the device will set the referencing parameter to {{empty}}. However, doing so under these circumstances might cause the updated {{object}} row to then violate the table's unique key constraint; if this occurs, the device MUST set {{param|Status}} to {{enum|Error_Misconfigured|Status}} and disable the offending {{object}} row. Enables or disables the {{object}} entry, indicating if NAT is enabled for the referenced IP Interface instance. On creation, an {{object}} entry is disabled by default. The status of this entry. {{enum}} The {{enum|Error_Misconfigured}} value indicates that a necessary configuration value is undefined or invalid. The {{enum|Error}} value MAY be used by the device to indicate a locally defined error condition. {{reference}} The associated IP interface on which NAT is to be enabled. Enables or disables the IPv4 spoofing protection. Spoofing protection prevents LAN devices from sending packets with a wrong source IP address. A number of DDoS attacks are known to modify the source IP address of packets to initiate a DDoS attack. Spoofing protection checks if the source IP address of packets initiated in the LAN belongs to the LAN interface Address range, otherwise the packet will be dropped early in the network stack. Enables or disables the IPv6 spoofing protection. Spoofing protection prevents LAN devices from sending packets with a wrong source IP address. A number of DDoS attacks are known to modify the source IP address of packets to initiate a DDoS attack. Spoofing protection checks if the source IP address of packets initiated in the LAN belongs to the LAN interface Address range, otherwise the packet will be dropped early in the network stack. When {{true}} the 'ICMPv4 echo request' packet must be answered with an 'ICMPv4 echo reply'. When {{false}} the 'ICMPv4 echo request' packet must be dropped. When {{true}} the 'ICMPv6 echo request' packet must be answered with an 'ICMPv6 echo reply'. When {{false}} the 'ICMPv6 echo request' packet must be dropped. When {{true}} the 'ICMPv6 echo request' packet must be forward to the LAN device. When {{false}} the 'ICMPv6 echo request' packet must be dropped. Enables or disables the stealth mode. Stealth mode defines how the firewall must treat "unwanted" packets. Typically the feature is enabled for WAN facing interface(s). Stealth mode is applicable for both IPv4 and IPv6, and UDP and TCP based protocols. If set to {{true}} all 'UDP/TCP' packets are dropped silently. This prevents a possible attacker from knowing which ports are opened/closed on a gateway. When {{param}} is set to {{false}}, the firewall will reply with an ICMP port unreachable. If there are other firewall rules in effect, they will have priority over this parameter. i.e: If an 'UDP' port is set to 'ACCEPT', and the {{param}} is activated, then the port will be accepted and all the other 'UDP' ports will be blocked. This Object contains the IP connection tracking related parameters. Application Layer Gateway (ALG) are used to provide Network Address Translation (NAT) support for various application-layer protocols. SIP is an application-layer control protocol used to establish, modify, and terminate multimedia sessions. Enables or disables the connection tracking support for the SIP protocol (SIP ALG). Port numbers of the SIP servers that need to be monitored. Allow media streams between signaling endpoints. Allow incoming calls from registrar. Allow media streams that are not passing through this router. When this feature is activated, the logic will maintain the SDP payload as is when it identifies that the interface towards the invited party is the same as the one towards the media endpoint. SIP time out session. H.323 is a VoIP signalling protocol from ITU-T Enables or disables the connection tracking support for the H323 protocol (H323 ALG). When no TTL is specified in the registration request message the TTL specified here will be used. Only accept calls from the gatekeeper. Create call forwarding expectations only when both endpoints are on different sides, as determined by routing information. Tracking FTP connections is difficult due to the requirement for specialized helpers to handle them, along with the complexities of masquerading and Network Address Translation. This involves supporting FTP on Layer 3 with independent connection tracking. Enables or disables the connection tracking support for the FTP protocol (FTP ALG). Port numbers of the FTP servers that need to be monitored. The FTP protocol can enable a user to connect a FTP server to another FTP server. This could lead to a hole in the DMZ and it is therefore recommended to disable this feature. PPTP Connection Tracking configuration object. Enables or disables the connection tracking support for the PPTP protocol (PPTP ALG). TFTP Connection Tracking configuration object. Enables or disables the connection tracking support for the TFTP protocol (TFTP ALG). Port numbers of the TFTP servers that need to be monitored. IRC Connection Tracking configuration object. Enables or disables the connection tracking support for the IRC protocol (IRC ALG). Port numbers of the IRC servers that need to be monitored. Maximum number of Direct Client-to-Client (DCC) channels allowed per IRC session. Timeout duration for unestablished Direct Client-to-Client (DCC) channels. This object is used for configuring sets of IP, MAC addresses and/or port numbers which can then be used in conjunction with the firewall. It provides a more efficient way to manage large collections of addresses and ports compared to traditional methods of listing them individually within firewall rules. Enables or disables this {{object}} entry. Indicates the Origin of the {{object}} instance. Used for indicating that the set rule was created by the end-user. For example through the web-ui. Used for indicating that the set rule was created by the system itself. Used for indicating that the set rule was created by a Controller. Human-readable name associated with this {{object}} entry. Describes the intention of the {{object|Rule}} entries and what it contains. The Rule set entry describes only a list of IPaddresses. The Rule set entry describes only a list of ports. The Rule set entry describes only a list of MAC addresses. IP Protocol Version as specified in {{bibref|IANA-ipversionnumbers}}. For example: * ''4'' (IPv4) * ''6'' (IPv6) {{numentries}} Firewall Rule object that is used for configuring the set lists. Specifies if this rule entry should match or not match the configured criteria. Source IPv4 or IPv6 address or subnet mask. Note: The IP version of the IP address MUST correspond to the IP version set in {{param|#.IPVersion}}. Can not be used in combination with {{param|MACAddressList}} or {{param|PortList}}. Specifies the MACAddress that can be used by the {{object}} entry. Note: Can not be used in combination with {{param|IPAddressList}} or {{param|PortList}}. Specifies the Port number or a port range that can be used by the {{object}} entry. Syntax: A single port can be configured as e.g. '80'. A port range can be configured as '8000-80010'. Note: Can not be used in combination with {{param|MACAddressList}} or {{param|IPAddressList}}. REQUIRED only for devices that support NAT.