Using Local Ip Address With An Unbound Network - D-Link NetDefend DFL-210 User Manual

4.2.1. The Principles of Routing
Chapter 4. Routing
IP Address of the above route, the clients will be able to communicate successfully with the
interface. The IP address chosen in the second network isn't significant, as long as it is the same
value for the Default Gateway of the clients and the Local IP Address.
The effect of adding the route with the Local IP Address is that the NetDefendOS will act as a
gateway with the Local IP Address and respond to, as well as send out, ARP queries as though the
interface had that IP address.
The diagram below illustrates a scenario where this feature could be used. The network 10.1.1.0/24
is bound to a physical interface that has an IP address within the network of 10.1.1.1. If we now
attach a second network 10.2.2.0/24 to the interface via the switch, it is unbound since the interface's
IP address doesn't belong to it.
Figure 4.1. Using Local IP Address with an Unbound Network
By adding a NetDefendOS route for this second network with the Local IP Address specified as
10.2.2.1, the interface will then respond to ARP requests from the 10.2.2.0/24 network. The clients
in this second network must also have their Default Gateway set to 10.2.2.1 in order to reach the
D-Link Firewall.
This feature is normally used when an additional network is to be added to an interface but it is not
desirable to change the existing IP addresses of the network. From a security standpoint, doing this
can present significant risks since different networks will typically be joined together through a
switch which imposes no controls on traffic passing between those networks. Caution should
therefore be exercised before using this feature.
All Traffic Must have Two Associated Routes
Something that is not intuitive when trying to understand routing in NetDefendOS is the fact that all
traffic must have two routes associated with it. Not only must a route be defined for the destination
network of a connection but also for the source network.
The route that defines the source network simply says that the source network is found on a
particular interface. When a new connection is opened, NetDefendOS performs a check known as a
reverse route lookup which looks for this route. The source network route is not used to perform
126