Ip Rule Sets; Security Policies - D-Link DFL-260E User Manual

3.5. IP Rule Sets

3.5. IP Rule Sets

3.5.1. Security Policies

Before examining IP rule sets in detail, we will first look at the generic concept of security polices
to which IP rule sets belong.
Security Policy Characteristics
NetDefendOS security policies are configured by the administrator to regulate the way in which
traffic can flow through the NetDefend Firewall. Such policies are described by the contents of
different NetDefendOS rule sets. These rule sets share a uniform means of specifying filtering
criteria which determine the type of traffic to which they will apply. The possible filtering criteria
consist of the following:
Source Interface
Source Network
Destination Interface
Destination Network
Service
The NetDefendOS Security Policy Rule Sets
The principle NetDefendOS rule sets that define NetDefendOS security policies, and which use the
same filtering parameters described above (networks/interfaces/service), include:
• IP Rules
These determine which traffic is permitted to pass through the NetDefend Firewall as well as
determining if the traffic is subject to address translation. They are described below.
• Pipe Rules
These determine which traffic triggers traffic shaping to take place and are described in
Section 10.1, "Traffic Shaping".
• Policy-based Routing Rules
An Interface or Interface Group where the packet is received at
the NetDefend Firewall. This could also be a VPN tunnel.
The network that contains the source IP address of the packet.
This might be a NetDefendOS IP object which could define a
single IP address or range of addresses.
An Interface or an Interface Group from which the packet
would leave the NetDefend Firewall. This could also be a VPN
tunnel.
The network to which the destination IP address of the packet
belongs. This might be a NetDefendOS IP object which could
define a single IP address or range of addresses.
The protocol type to which the packet belongs. Service objects
define a protocol/port type. Examples are HTTP and ICMP.
Service objects also define any ALG which is to be applied to the
traffic
NetDefendOS provides a large number of predefined service
objects but administrator defined custom services can also be
created. Existing service objects can also be collected together
into service groups.
See Section 3.2, "Services" for more information about this topic.
121
Chapter 3. Fundamentals