Groups; Traffic Grouped Per Ip Address - D-Link NetDefend DFL-210 User Manual

10.1.9. Groups

Keep the forward chain of both rules as std-out only. Again, to simplify this example, we
concentrate only on inbound traffic, which is the direction that is the most likely to be the first one
to fill up in client-oriented setups.
Set the return chain of the port 22 rule to ssh-in followed by std-in.
Set the return chain of the port 23 rule to telnet-in followed by std-in.
Set the priority assignment for both rules to Use defaults from first pipe; the default precedence of
both the ssh-in and telnet-in pipes is 2.
Using this approach rather than hard-coding precedence 2 in the rule set, you can easily change the
precedence of all SSH and Telnet traffic by changing the default precedence of the ssh-in and
telnet-in pipes.
Notice that we did not set a total limit for the ssh-in and telnet-in pipes. We do not need to since the
total limit will be enforced by the std-in pipe at the end of the respective chains.
The ssh-in and telnet-in pipes act as a "priority filter": they make sure that no more than the
reserved amount, 64 and 32 kbps, respectively, of precedence 2 traffic will reach std-in. SSH and
Telnet traffic exceeding their guarantees will reach std-in as precedence 0, the best-effort
precedence of the std-in and ssh-in pipes.
10.1.9. Groups
NetDefendOS provides further granularity of control within pipes through the ability to split pipe
bandwidth according to either the packet's source/destination network, IP, port or interface. This is
referred to as creating Groups where the members of a group, sometimes called the users, can have
limits and guarantees applied to them. The most common usage of this division of traffic is to group
by IP or interface.
Figure 10.5. Traffic grouped per IP address
If grouping by port is used then this implicitly also includes the IP address so that port 1024 of
Note: The return chain ordering is important
Here, the ordering of the pipes in the return chain is important. Should std-in appear
before ssh-in and telnet-in, then traffic will reach std-in at the lowest precedence only
and hence compete for the 250 kbps of available bandwidth with other traffic.
411
Chapter 10. Traffic Management