Blacklisting Hosts And Networks - D-Link NetDefend DFL-210 User Manual

6.7. Blacklisting Hosts and Networks

6.7. Blacklisting Hosts and Networks
Overview
NetDefendOS implements a Blacklist of host or network IP addresses which can be utilized to
protect against traffic coming from specific Internet sources.
Certain NetDefendOS subsystems have the ability to optionally blacklist a host or network when
certain conditions are encountered. These subsystems are:
• Intrusion Detection and Prevention (IDP).
• Threshold Rules. (Available on certain NetDefend models only - see Section 10.3, "Threshold
Rules" for details.)
Blacklisting Options
The automatic blacklisting of a host or network can be enabled in IDP and in Threshold Rules by
specifying the Protect action for when a rule is triggered. Once enabled there are three blacklisting
options:
Time to Block Host/Network in
seconds
Block only this Service
Exempt already established
connections from Blacklisting
IP addresses or networks are added to the list then the traffic from these sources is then blocked for
the period of time specified.
Whitelisting
To ensure that Internet traffic coming from trusted sources, such as the management workstation,
are not blacklisted under any circumstances, a Whitelist is also maintained by NetDefendOS. Any IP
address object can be added to this whitelist
It is also important to understand that although whitelisting prevents a particular source from being
Note: Restarts do not effect the blacklist
The contents of the blacklist is not lost if the NetDefend Firewall shuts down and
restarts.
Tip: Important IP addresses should be whitelisted
It is recommended to add the NetDefend Firewall itself to the whitelist as well as the
IP address or network of the management workstation since blacklisting of either
could have serious consequences for network operations.
The host or network which is the source of the traffic will
stay on the blacklist for the specified time and then be
removed. If the same source triggers another entry to the
blacklist then the blocking time is renewed to its original, full
value (in other words, it is not cumulative).
By default Blacklisting blocks all services for the triggering
host.
If there are established connections that have the same source
as this new Blacklist entry then they will not be dropped if
this option is set.
294
Chapter 6. Security Mechanisms