The Tftp Alg - D-Link NetDefendOS User Manual

3. For Address Filter enter:
• Source Interface: lan
• Destination Interface: wan
• Source Network: lannet
• Destination Network: all-nets
4. Check Use Interface Address
5. Click OK
Setting Up FTP Servers with Passive Mode
An important point about FTP server setup needs to be made if the FTP ALG is being used along
with passive mode.
Usually, the FTP server will be protected behind the NetDefend Firewall and NetDefendOS will
SAT-Allow connections to it from external clients that are connecting across the public Internet. If
FTP Passive mode is allowed and a client connects with this mode then the FTP server must
return an IP address and port to the client on which it can set up the data transfer connection.
This IP address is normally manually specified by the administrator in the FTP server software and
the natural choice is to specify the external IP address of the interface on the firewall that
connects to the Internet. This is, however, wrong if the FTP ALG is being used.
Instead, the local, internal IP address of the FTP server should be specified when setting up the
FTP server.

6.2.5. The TFTP ALG

Overview
Trivial File Transfer Protocol (TFTP) is a much simpler version of FTP with more limited capabilities.
Its purpose is to allow a client to upload files to or download files from a host system. TFTP data
transport is based on the UDP protocol and therefore it supplies its own transport and session
control protocols which are layered onto UDP.
TFTP is widely used in enterprise environments for updating software and backing up
configurations on network devices. TFTP is recognized as being an inherently insecure protocol
and its usage is often confined to internal networks. The NetDefendOS ALG provides an extra
layer of security to TFTP in being able to put restrictions on its use.
General TFTP Options
Allow/Disallow Read
Allow/Disallow Write
The TFTP GET function can be disabled so that files cannot
be retrieved by a TFTP client. The default value is Allow.
The TFTP PUT function can be disabled so that files cannot
be written by a TFTP client. The default value is Allow.
447
Chapter 6: Security Mechanisms