D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 101 / 469

3.5. The IP Rule Set
3.5.1. Security Policies
Common Policy Characteristics
NetDefendOS Security Policies designed by the administrator, regulate the way in which traffic can
flow through the D-Link Firewall. Policies in NetDefendOS are defined by different NetDefendOS
rule sets. These rule sets share a common means of specifying filtering criteria which determine the
type of traffic to which they will apply. This set of criteria consists of:
Source Interface An Interface or Interface Group where the packet is received at
the D-Link Firewall. This can also be a VPN tunnel.
Source Network The network that contains the source IP address of the packet.
This might be a NetDefendOS IP object which could define a
single IP address or range of addresses.
Destination Interface An Interface or an Interface Group from which the packet
would leave the D-Link Firewall. This can also be a VPN tunnel.
Destination Network The network to which the destination IP address of the packet
belongs. This might be a NetDefendOS IP object which could
define a single IP address or range of addresses.
Service The protocol type to which the packet belongs. Service objects
define a protocol/port type. Examples might be HTTP or ICMP.
Custom services can also be defined. See Section 3.2, “Services”
for more information on this topic.
The NetDefendOS Security Policy Rulesets
The principle NetDefendOS rule sets that define NetDefendOS security policies, and which use the
same filtering parameters described above (networks/interfaces/service), include:
• IP Rules
These determine which traffic is permitted to pass through the D-Link Firewall as well as
determining if the traffic is subject to address translation. They are described below.
• Pipe Rules
These determine which traffic triggers traffic shaping to take place and are described in
Section 10.1, “Traffic Shaping”.
• Policy-based Routing Rules
These determine the routing table ro be used by traffic and are described in Section 4.3,
“Policy-based Routing”.
• Authentication Rules
These determine which traffic triggers authentication to take place (source net/interface only)
and are described in Chapter 8, User Authentication.
Specifying Any Interface or Network
3.5. The IP Rule Set Chapter 3. Fundamentals
101