The security profiles control the firewall: what to allow and what to refuse.
Only advanced users are recommended to change the security profiles.

Press "Get default values" to restore the security profiles to their original values.

NOTE! Press "Apply" after your settings!

Allowed applications

Applications allowed to get in through the firewall (from WAN to LAN):

Web, Telnet, SSH, FTP server - Check box if you have any of these servers on your LAN, and you want computers on the Internet to be able to access them. Enter the server's local IP address. Check "Use Built-in Web server" to use this unit as your web server to the Internet. The FTP server Port field controls your external FTP port - your FTP server shall still listen to port 21!

Access servers from inside using WAN IP address - Check box if you want to be able to access your web, telnet, ssh or ftp server from inside using your global IP address. If box is not checked the servers can only be reached using their local IP address.

PING receiver - Check box if you want ping-requests from the Internet answered by a PC on your LAN. Enter the PC's LAN IP address.
(Not recommended, as it is a security risk at "flood-pinging")

SIP - Check box if you want incoming SIP messages to be allowed through / answered.

Remote configuration Web/Telnet/SNMP - Check box(es) if you want the configuration web interface (these pages), the command line interface (Telnet with port 57) or the SNMP server resp. to be accessible from the Internet. Choose if you want to use http (with port 66), https (with port 78), or both of them, when accessing the web pages from outside.
(NOTE! Security risk!)

ICQ 2003a/Lite - Check box if you want to communicate with other ICQ users.
NOTE! Port range is set to 1024-2048, you must specify this range in ICQ. Follow the link under "Read more online" (bottom of page) for instructions.
NOTE! Security risk (opens up a large hole in firewall)! Not recommended. If you only want to utilize the "Send Message" feature check ICQ box under "Applications from inside" instead (more secure).

Multi-user gaming support:
Some games where many users can play with each other over the Internet demand that the firewall allows non-conventional data traffic. The "Lo" security profile is pre-configured for most such games (as "All" is checked at "Applications from inside" and "loose UDP" is enabled). Some DirectX-based games though might demand that the DirectX checkbox is enabled.

DirectX - Check box if you want to play games using the Microsoft DirectX communication module:
(Ages of Empire, Midtown Madness, Motocross Madness, most Microsoft-games, many Windows-games)


NOTE! Press "Apply" after your settings!

VPN Pass-through

VPN tunnels to allow through the firewall. For each tunnel enter:
Protocol - VPN communication protocol used in the tunnel.
Local client IP - IP address of local VPN client the tunnel is going from.
Remote server IP - IP address of remote VPN server the tunnel is going to.

Enter both endpoints' IP for each tunnel. Each tunnel must have a unique remote server IP address, meaning no two tunnels are allowed to go to same remote server.

NOTE! Press "Apply" after your settings!

Port redirection

Manual port redirections from WAN to LAN ports. (only for advanced users)

TCP connections - Rules for data traffic using TCP packets.
UDP connections - Rules for data traffic using UDP packets.
outside port(s) - WAN port(s) to be opened.
inside host - IP address of LAN PC that should receive the data traffic.
inside port - Leave blank if same as outside ports!

NOTE! Press "Apply" after your settings!

IP redirections

Manual IP protocol/address redirections from WAN to LAN. (only for advanced users)
Redirections selected in priority order, 1:st row first.

Protocol - Protocol number or (for common protocols) name. Leave blank for "all protocols".
outside IP address - Global IP address that is to be redirected. Only if you have received more than one global IP address from your Internet provider. Else leave empty.
inside IP address - IP address of LAN PC that should receive the data traffic.

NOTE! Press "Apply" after your settings!

Additional rules
Only for the advanced user!
NB! Changing these settings requires in depth knowledge!

Advanced users can here add manually written firewall rules to the automatically generated ones.

Insert at position - Firewall ruleset to add rule to, as seen on Firewall Rules page. (NOTE! All three fields MUST be chosen!)
pre - add rule before the automatically generated ones - the rule will have higher priority.
post - add rule after the automatically generated ones - the rule will have lower priority.
subst - substitute automatically generated rules with the entered one. WARNING! No rules will be auto-generated for that ruleset!
Firewall rule - ONE firewall rule to add at specified position.

To add multiple rules to a ruleset enter multiple entries. To delete entries set their position fields to empty.

Read more online:
Firewall rule syntax

NOTE! Press "Apply" after your settings!
After editing these settings it is highly recommended to check system log and Firewall Rules Status page for errors.

Applications from inside

Applications allowed to get out through the firewall (from LAN to WAN):

All - Allow all outgoing data traffic to pass through. No filtering. (NOTE! Security risk! Not recommended!)
All TCP - Allow all outgoing TCP packets to pass through. (Not recommended)
All UDP - Allow all outgoing UDP packets to pass through. (Not recommended)
Web - Allow web access ("surfing").
NNTP - Allow access to newsgroups.
POP3 - Allow reception of e-mail.
IMAP - Allow reception of e-mail.
SMTP - Allow sending e-mail.
FTP - Allow file transfers on selected port(s).
RTSP proxy - Allow listening to web radio/tv on selected port(s) by using the builtin RTSP proxy.
Ping - Allow outgoing ping (a LAN PC pinging to a PC on WAN / Internet).
IGMP/Multicast - Allow reception of multicasted data streams.
Yahoo! Messenger 5.5 - Check box if you want to communicate with other Yahoo! Messenger users.
AOL Instant Messenger (AIM) 5.1 - Check box if you want to communicate with other AOL Instant Messenger users.
Net2Phone 1.0 - Check box if you want to utilize the Net2Phone application.
ICQ (Send Message only) - Check box if you only want to send messages to other ICQ users. To utilize the more advanced feautures check ICQ box under "Allowed applications" instead.
inside -> DMZ - Allow all, all TCP or all UDP traffic from LAN to DMZ.
Other TCP ports - Open specific port numbers (only for advanced users) (several ports can be entered, separated by comma)
Other UDP ports - Open specific port numbers (only for advanced users) (several ports can be entered, separated by comma)

Administration (Telnet) - Allow access to command line interface.
Administration (SNMP) - Allow access to internal SNMP Server.

NOTE! Press "Apply" after your settings!

Internet filter

Also called "Parental control". Block visits to certain Internet sites. Denies access to certain Internet sites - users behind this unit cannot access them. You can also deny download of certain file types.

Internet filter - Check box to enable filtering of web accesses.
Block sites - Enter a list of sites (comma separated) users should not be able to access. Compares the hostname part of the URL - the part before the first "/". Do not include the starting "www." part. Sites with their full name matching are blocked. If you do not specify the top-level domain all domains are denied.
Example: "youtube.com,google" stops access to www.youtube.com, google.com, and google.co.uk, but allows youtube.co.uk, googlefight.com and en.wikipedia.org/wiki/google
Block IP numbers - Block use of IP address in URL (eg http://213.136.58.99)
Block filetypes - Enter a list of file extensions (comma separated) users should not be able to download. Compares the path part of the URL - the part after the first "/". Include the starting dot. File types exactly matching the extensions are blocked.
Example: ".exe,.gz" stops downloads of executable and gz-compressed files, though .gzip files can still be downloaded.
Allow all browsing from IP addresses - Enter a list of IP addresses (comma separated) users can surf unlimited from. Hosts with listed IP addresses can still access any site on the Internet regardless of Internet filter settings.
NOTE: By enabling Log blocked access attempts on the Log Configuration page all web access attempts blocked by the Internet filter will be logged into the system log.

Read more online:
Internet filter

General settings

Other security profile settings:

Loose UDP (Peer-to-peer gaming) - Many games use "loose UDP" for communicating between several users over the Internet:
e.g. BattleZone1.4, Dark Reign1.4, Diablo, HeavyGear2, Quake I/II, StarCraft, WorldCraft, and most of the games from Activision
Check the box to allow such traffic to pass through.

Disable "ICMP close" (Port Unreachable) - Avoid "UDP connections" from being closed by ICMP Port Unreachable messages.

Enable strict TCP inspection - Uncheck this if encountering compatibility problems with certain servers.

SYN flood detection - Checking this box will protect against an attack using flooding with SYN messages (SYN is the initial message for opening a TCP connection).

IGMP/Multicast Proxy - If enabled multicasted data streams are proxied, delivered only to the subnet the requesting client is on. If this proxy is disabled all received multicast data streams are forwarded to all local subnets.
ET1,ET2,ET3, ET4, AIR - Select what local interfaces are allowed to receive multicasted data streams. This setting affects only interfaces categorised as "inside" on the Network Configuration page - DMZ and other interfaces never receive multicast regardless of these settings.
NB! You must enable IGMP/Multicast at Applications from inside on this page to allow multicast traffic through the firewall!
The Internet connection of the multicast proxy is by default the current WAN interface, unless specified otherwise on the Extra WAN Interfaces page.

FTP proxy mode - Select if FTP traffic should be subject to the internal FTP proxy. "Disabled" means that only address translation (NAT) is performed. NB! FTP traffic is still admitted/rejected based on the other FTP settings on this page.

Inactivity timeouts - Close the connection if no data has been transmitted for the specified time. Specific timeouts for particular ports/protocols may be added.

NOTE! Press "Apply" after your settings!

Read more online:
Security Profile