D-Link DFL-1660 User Manual page 109

3.4.1. Overview
Tunnel interfaces are used when network traffic is being tunneled between the system and
another tunnel end-point in the network, before it gets routed to its final destination. VPN
tunnels are often used to implement virtual private networks (VPNs) which can secure
communication between two firewalls.
To accomplish tunneling, additional headers are added to the traffic that is to be tunneled.
Furthermore, various transformations can be applied to the network traffic depending on the type
of tunnel interface. For example, when routing traffic over an IPsec interface, the payload is
usually encrypted to achieve confidentiality.
NetDefendOS supports the following tunnel interface types:
i. IPsec interfaces are used as end-points for IPsec VPN tunnels. More information about this
topic can be found in Section 9.3, "IPsec Components".
ii. PPTP/L2TP interfaces are used as end-points for PPTP or L2TP tunnels. More information
about this topic can be found in Section 9.5, "PPTP/L2TP".
iii. GRE interfaces are used to establish GRE tunnels. More information about this topic can be
found in Section 3.4.5, "GRE Tunnels".
All Interfaces are Logically Equivalent
Even though the different types of interfaces may be very different in the way they function,
NetDefendOS treats all interfaces as logically equivalent. This is an important and powerful concept
and means that all types of interfaces can be used almost interchangeably in the various
NetDefendOS rule sets and other configuration objects. This results in a high degree of flexibility in
how traffic can be examined, controlled and routed.
Interfaces have Unique Names
Each interface in NetDefendOS is given a unique name to be able to identify and select it for use
with other NetDefendOS objects in a configuration. Some interface types, such as physical Ethernet
interfaces, are already provided by NetDefendOS with relevant default names that are possible to
modify if required. New interfaces defined by the administrator will always require a user-provided
name to be specified.
The any and core Interfaces
In addition, NetDefendOS provides two special logical interfaces which are named any and core.
The meaning of these are:
• any represents all possible interfaces including the core interface.
• core indicates that it is NetDefendOS itself that will deal with traffic to and from this interface.
Examples of the use of core are when the NetDefend Firewall acts as a PPTP or L2TP server or
responds to ICMP "Ping" requests. By specifying the Destination Interface of a route as core,
NetDefendOS will then know that it is itself that is the ultimate destination of the traffic.
Warning
If an interface definition is removed from a NetDefendOS configuration, it is important
to first remove or change any references to that interface. For example, rules in the IP
rule set that refer to that interface should be removed or changed.
109
Chapter 3. Fundamentals