Icmp Services; Adding A Tcp/Udp Service - D-Link NetDefend DFL-210 User Manual

3.2.3. ICMP Services

Example 3.8. Adding a TCP/UDP Service
This example shows how to add a TCP/UDP Service, using destination port 3306, which is used by MySQL:
CLI
gw-world:/> add Service ServiceTCPUDP MySQL DestinationPorts=3306 Type=TCP
Web Interface
1. Go to Objects > Services > Add > TCP/UDP service
2. Specify a suitable name for the service, for instance MySQL.
3. Now enter:
• Type: TCP
• Source: 0-65535
• Destination: 3306
4. Click OK.
Apart from protocol and port information, TCP/UDP Service objects also contain several other para-
meters that are being described in more detail in other sections of this users guide:
SYN Flood Protection
Passing ICMP Errors
Application Layer Gateway
3.2.3. ICMP Services
Internet Control Message Protocol (ICMP), is a protocol integrated with IP for error reporting and
transmitting control information. The PING service, for example, uses ICMP to test an Internet con-
nectivity.
ICMP messages is delivered in IP packets, and includes a Message Type that specifies the type, that
is, the format of the ICMP message, and a Code that is used to further qualify the message. For ex-
ample, the message type Destination Unreachable, uses the Code parameter to specify the exact
reason for the error.
Tip
The above methods of specifying port numbers are not used just for destination ports.
Source port definitions can follow the same conventions, although it is most usual that
the source ports are left as their default values, namely 0-65535, which matches all
possible source ports.
A TCP based service can be configured to enable protection
against SYN Flood attacks. For more details on how this fea-
ture works see Section 6.6.8, "TCP SYN Flood Attacks".
If an attempt to open a TCP connection is made by a user ap-
plication behind the D-Link Firewall and the remote server is
not in operation, an ICMP error message is returned as the re-
sponse. These ICMP errors can either be ignored or allowed
to pass through, back to the requesting application.
A TCP/UDP Service can be linked to an Application Layer
Gateway to enable deeper inspection of certain protocols. For
more information, please see Section 6.2, "Application Layer
Gateways".
37
Chapter 3. Fundamentals