Traffic Filtering

AMRES filters the network traffic in order to ensure protection against Internet attack and to preserve primary function of AMRES network. Protection of network and server infrastructure connected with AMRES infrastructure as well as AMRES end users is performed by this proactive approach. 

Traffic filtering is performed at two levels:

• Filtering at transport level, filters unauthorized protocols. More details about this filtering method are given below.
• Filtering of web-traffic by means of Web-proxy service, end users are protected against malware on web pages and high quality link to the Internet for the needs of scientific-research network is ensured.

Filtering at Transport Level

Filtering of network traffic at transport level means filtering of applications and services by means of filters (Firewall Filter / Access Control List) on AMRES network devices. Applications and services use certain protocols and communication ports, and filters on network devices define rules about which protocols and ports are allowed for traffic forwarding in the network. If the protocol and the port used by certain service or application are not allowed in network filters, the observed application or service will not be available in AMRES network.

Filtering of network traffic is performed at:

• AMRES’ Points of Presence (PoP) and
• AMRES main site.

Filtering in AMRES Points of Presence

AMRES’ PoP is the place in AMRES’ network where the infrastructure of AMRES’ user is connected to AMRES’ network. AMRES’ access points include network devices which filter traffic coming from AMRES users and entering AMRES network. Traffic filtering at AMRES access point is aimed at filtration of the most vulnerable network services which are mostly not used and which may harm proper functioning of AMRES infrastructure and other AMRES users. The following services are filtered at AMRES PoP:

If AMRES institution has its own email server, it should report IP addresses email servers to AMRES so that those servers could be exempt from filtering SMTP traffic. Institution’s technical contact is responsible for reporting  IP address of email server to AMRES by sending an email to AMRES helpdesk. Excluding services explicitly specified in the table above, all other traffic is allowed.

Filtering at AMRES main site             

AMRES main site infrastructure is the core of AMRES network which includes network devices and equipment that connect AMRES to the Internet. Traffic filtering at AMRES main site is aimed at regulation of traffic that AMRES institutions exchange with the Internet. It allows the set of basic and most frequently used services while it filters all other traffic. Filtering of other protocols and services is performed in order to prevent malicious traffic from the Internet which may harm proper functioning of AMRES infrastructure and other AMRES institutions. The following services and protocols are allowed when communicating with the Internet:

Excluding services explicitly specified in the table above, all other traffic is filtered.

If AMRES institution needs to use certain service or protocol which is filtered according to AMRES policy, institution’s technical contact has to send an email with request to AMRES helpdesk to exempt it from the global filtering policy, with the IP addresses and ports for which communication should be allowed as well as short explanation for using the service/protocol. AMRES will respond to the request as soon as possible.