D-Link 800 - DFL 800 - Security Appliance, User Manual, Page: 206 / 469

Rules (Using Public IPs). The following rule needs to be added to the IP rules if using public IP's; make sure there
are no rules disallowing or allowing the same kind of ports/traffic before these rules. The service in use is the
ftp-outbound, which should be using the ALG definition ftp-outbound as described earlier.
C. Allow connections to ftp-servers on the outside:
1. Go to Rules > IP Rules > Add > IPRule
2. Now enter:
• Name: Allow-ftp-outbound
• Action: Allow
• Service: ftp-outbound
3. For Address Filter enter:
• Source Interface: lan
• Destination Interface: wan
• Source Network: lannet
• Destination Network: all-nets
4. Click OK
D. Rules (Using Private IPs). If the firewall is using private IP's, the following NAT rule need to be added instead:
1. Go to Rules > IP Rules > Add > IPRule
2. Now enter:
• Name: NAT-ftp-outbound
• Action: NAT
• Service: ftp-outbound
3. For Address Filter enter:
• Source Interface: lan
• Destination Interface: wan
• Source Network: lannet
• Destination Network: all-nets
4. Check Use Interface Address
5. Click OK
6.2.4. The TFTP ALG
Trivial File Transfer Protocol (TFTP) is a much simpler version of FTP with more limited
capabilities. Its purpose is to allow a client to upload files to or download files from a host system.
TFTP data transport is based on the UDP protocol and therefore it supplies its own transport and
session control protocols which are layered onto UDP.
TFTP is widely used in enterprise environments for updating software and backing up
configurations on network devices. TFTP is recognized as being an inherently insecure protocol and
its usage is often confined to internal networks. The NetDefendOS ALG provides an extra layer of
security to TFTP in being able to put restrictions on its use.
General TFTP Options
6.2.4. The TFTP ALG Chapter 6. Security Mechanisms
206