Ip Rule Evaluation; Simplified Netdefendos Traffic Flow - D-Link NetDefend DFL-210 User Manual

3.5.2. IP Rule Evaluation

If the IP rule used is an Allow rule then this is bi-directional by default.
The ordering of these steps is important. The route lookup occurs first to determine the exiting
interface and then NetDefendOS looks for an IP rule that allows the traffic to leave on that interface.
If a rule doesn't exist then the traffic is dropped.
Figure 3.2. Simplified NetDefendOS Traffic Flow
This description of traffic flow is an extremely simplified version of the full flow description found
in Section 1.3, "NetDefendOS State Engine Packet Flow".
For example, before the route lookup is done, NetDefendOS actually first checks that the source
network for the traffic should, in fact, be arriving on the interface where it was received. This is
done by NetDefendOS performing a reverse route lookup which means that the routing tables are
searched for a route that indicates the network is found on that interface.
This second route should logically exist if a connection is bi-directional and it must have a pair of
routes associated with it, one for each direction.
3.5.2. IP Rule Evaluation
When a new connection, such as a TCP/IP connection, is being established through the NetDefend
Firewall, the list of IP rules are evaluated from top to bottom until a rule that matches the parameters
of the new connection is found. The first matching rule's Action is then performed.
If the action allows it then the establishment of the new connection will go ahead. A new entry or
state representing the new connection will then be added to the NetDefendOS internal state table
which allows monitoring of opened and active connections passing through the NetDefend Firewall.
If the action is Drop or Reject then the new connection is refused.
Tip: Rules in the wrong order sometimes cause problems
It is important to remember the principle that NetDefendOS searches the IP rules from
top to bottom, looking for the first matching rule.
If an IP rule seems to be ignored, check that some other rule above it isn't being
triggered first.
111
Chapter 3. Fundamentals