As discussed in section , this is a potential backdoor and could negate all the protection provided by the firewall. A much better method for handling modems is to concentrate them into a modem pool, and then secure connections from that pool. The modem pool likely would consist of modems connected to a terminal server, which is a specialized computer designed for connecting modems to a network. Some terminal servers provide security features that can restrict connections to specific systems, or require users to authenticate using an authentication token.
Figure shows a modem pool located on the Internet side of the screened host firewall.
Since the connections from modems need to be treated with the same suspicion as connections from the Internet, locating the modem pool on the outside of the firewall forces the modem connections to pass through the firewall. The application gateway's advanced authentication measures can be used then to authenticate users who connect from modems as well as from the Internet. The packet filtering router could be used to prevent inside systems from connecting directly to the modem pool. A disadvantage to this, though, is that the modem pool is connected directly to the Internet and thus more exposed to attack. If an intruder managed to penetrate the modem pool, the intruder might use it as a basis for connecting to and attacking other Internet systems.