Administrator's Guide - Kerio Software Archive

Firewall and Intrusion Prevention System
Ignored intrusions
In some cases, legitimate traffic may be detected as an intrusion. If this happens
frequently or even regularly, it may be helpful to define an exception for the particular
intrusion. Exceptions are defined by adding the rule ID number in the list. Identifier
of the rule can be found in the Security log (see chapter 22.11), or in the Snort system
documentation (http://www.snort.org/).
Note: Exceptions are helpful only in cases where legitimate traffic is detected as an
intrusion repeatedly or even better — regularly. It may be harmful to define exceptions
after the first time such a problem is detected.
Protocol-specific intrusions
Some intrusions may target security weaknesses in specific application protocols.
Therefore, it is usually not helpful to detect these intrusions in traffic of other application
protocols. For individual protocols recognized by the intrusion detection system, lists of
standard and frequently used ports are predefined. The lists may include individual port
numbers separated by commas or port ranges (initial and final port separated by a dash,
non-spaced).
If an application is available from the Internet that uses any of the listed protocols on
a non-standard port (e.g. HTTP on port 10000), it can be helpful to add this port in list
of ports on which HTTP-specific intrusions will be detected.
If, on the other hand, an application using a different protocol is used on a listed port
(e.g. VPN server on port 8000), it is recommended to remove this port from the list of
ports for the particular protocol — it is meaningless to perform detection on the port, the
detection process would be a redundant load for the firewall and false positives might
also occur.
8.2 MAC address filtering
Besides Traffic Rules that filter network traffic by using IP addresses, protocols and ports (see
chapter 7), Kerio Control also allows “low-level” filtering by hardware addresses (so called MAC
addresses) of individual computers and network devices. Filtering of physical address helps
for example prevent users from undesirable connections to the network or get around the
firewall traffic policy by changing IP address of their device.
Note: The MAC address filter works on lower level than the firewall’s traffic rules (see
chapter 7) and it is therefore applied earlier than traffic rules.
MAC address filtering can be configured under Configuration → Traffic Policy → Security Options.
Network interfaces
The MAC address filter can be applied on any network Ethernet or WiFi interface of the
firewall. However, it is recommended to select only such interface on which network
traffic should be filtered. If you want to block unwanted devices in local network, there
is no reason to use filtering of MAC addresses on web interfaces. This might mean
a redundant load on the firewall and it can also cause blocking of Internet traffic.
116