Fields - D-Link DFL-1600 User Manual

110
connection is found. The action of the rule is then carried out. If the action
is Allow, the connection will be established and a state representing the
connection is added to the firewall's internal state table. If the action is
Drop, the new connection will be refused.
matching one decides what will happen to the connection. (Except for SAT
rules, shown in Example.)
Consecutive packets belonging to an existing connection will not need to be
evaluated again. Instead, a highly optimized state-lookup algorithm will
search the internal state table for an existing state representing the
connection. This methodology is applied not only on TCP connections, but
on UDP and ICMP traffic as well. Thus, the size of the firewall ruleset does
not affect the throughput of the firewall.
A rule is expressed in a definite form, consisting of two logical parts: the
fields and the action. The subsections below explain the parameters of a
rule that are available in D-Link firewalls.
14.1.1

Fields

Fields are some pre-defined and reusable network objects, such as Addresses
and Services, which are used by every rule for matching purpose. The
following fields in the rule list are used by the firewall to check a packet in
the traffic flow. All these filtering fields have to match the contents of a
packet for any rule to trigger.
Service: the protocol type that the packet must match.
(Services are defined as logical objects before configuring the rules,
see 8.2 Services
Source Interface: one or a group of interfaces where the packet is
received on the firewall.
Source Network: the network that the source IP address of the
packet matches.
Destination Interface: one or a group of interfaces where the
packet is aiming at.
Destination Network: the network that the destination IP address
of the packet matches.
– If there are several matching rules, the first
)
D-Link Firewalls User's Guide
Chapter 14. IP Rules