Protocol-Independent Settings - D-Link DFL-200 User Manual

Protocol-independent settings

Allow ICMP errors from the destination to the source – ICMP error messages are sent in
several situations: for example, when an IP packet cannot reach its destination. The purpose
of these error control messages is to provide feedback about problems in the communication
environment.
However, ICMP error messages and firewalls are usually not a very good combination; the
ICMP error messages are initiated at the destination host (or a device within the path to the
destination) and sent to the originating host. The result is that the ICMP error message will be
interpreted by the firewall as a new connection and dropped, if not explicitly allowed by the
firewall rule-set. It is generally not a good idea to allow any inbound ICMP message to be able
to have those error messages forwarded.
To solve this problem, the DFL-200 can be instructed to pass an ICMP error message only if it
is related to an existing connection. Check this option to enable this feature for connections
using this service.
ALG – Similar to the way most stateful inspection firewalls behave, the DFL-200 filters only
information found in packet headers, such as IP, TCP, UDP, or ICMP headers.
In some situations though, filtering only header data is not sufficient. The FTP protocol, for
instance, includes IP address and port information in the protocol payload. In these cases, the
firewall needs to be able to examine the payload data and carry out appropriate actions. The
DFL-200 provides this functionality using Application Layer Gateways (ALG).
To use an Application Layer Gateway, the appropriate Application Layer Gateway definition is
selected in the dropdown menu. The selected Application Layer Gateway will thus manage
network traffic that matches the policy using this service.
Currently, the DFL-200 supports two Application Layer Gateways, one is used to manage the
FTP protocol and the other one is a HTTP Content Filtering ALG. For detailed information
about how to configure the HTTP Application Layer Gateway, please see the Content Filtering
chapter.
42