Adding A Tcp/Udp Service - D-Link NetDefend DFL-210 User Manual

3.2.2. TCP and UDP Based Services
Example 3.8. Adding a TCP/UDP Service
This example shows how to add a TCP/UDP Service, using destination port 3306, which is used by MySQL:
CLI
gw-world:/> add Service ServiceTCPUDP MySQL DestinationPorts=3306 Type=TCP
Web Interface
1. Go to Objects > Services > Add > TCP/UDP service
2. Specify a suitable name for the service, eg. MySQL
3. Now enter:
• Type: TCP
• Source: 0-65535
• Destination: 3306
4. Click OK
Apart from protocol and port information, TCP/UDP Service objects also contain several other
parameters that are being described in more detail in other sections of this users guide:
SYN Flood Protection
Passing ICMP Errors
Application Layer Gateway
Max Sessions
An important parameter associated with a Service is Max Sessions. This parameter is allocated a
default value when the Service is associated with an ALG. The default value varies according to the
ALG it is associated with. If the default is, for example 100, this would mean that only 100
connections are allowed in total for this Service across all interfaces.
For a Service involving, for instance an HTTP ALG, the default value can often be too low if there
are large numbers of clients connecting through the D-Link Firewall. It is therefore recommended to
consider if a higher value is required for a particular scenario.
Using All Services
Tip
The above methods of specifying port numbers are used not just for destination ports.
Source port definitions can follow the same conventions, although it is most usual that
the source ports are left as the default value which is 0-65535 and this corresponds to
all possible source ports.
A TCP based service can be configured to enable protection
against SYN Flood attacks. For more details on how this
feature works see Section 6.6.8, "TCP SYN Flood Attacks".
If an attempt to open a TCP connection is made by a user
application behind the D-Link Firewall and the remote server
is not in operation, an ICMP error message is returned as the
response. These ICMP errors can either be ignored or allowed
to pass through, back to the requesting application.
A TCP/UDP Service can be linked to an Application Layer
Gateway to enable deeper inspection of certain protocols. For
more information see Section 6.2, "Application Layer
Gateways".
54
Chapter 3. Fundamentals