D-Link NetDefendOS, User Manual

Page: 228 / 912

3.6. IP Rules and IP Policies
3.6.1. Security Policies
Before examining IP rule sets in detail, we will first look at the generic concept of security policies
to which IP rule sets belong.
Security Policy Filtering
NetDefendOS security policies are configured by the administrator to regulate which traffic can
flow through the NetDefend Firewall and how traffic is examined and changed as it flows. Such
policies are described by the contents of different NetDefendOS
rule sets . These rule sets share a
uniform means of specifying filtering criteria which determine the type of traffic to which they
will apply. The filtering criteria usually consist of the following:
Source Interface An Interface or Interface Group where the packet is received
at the NetDefend Firewall. This could also be a VPN tunnel.
Source Network The network that contains the source IP address of the packet.
This might be a NetDefendOS IP object which could define a
single IP address or range of addresses.
Destination Interface An Interface or an Interface Group from which the packet
would leave the NetDefend Firewall. This could also be a VPN
tunnel.
Destination Network The network to which the destination IP address of the packet
belongs. This might be a NetDefendOS IP object which could
define a single IP address or range of addresses.
Service The protocol type to which the packet belongs. Service objects
define a protocol/port type. Examples are HTTP and ICMP.
Service objects also define any ALG which is to be applied to the
traffic
NetDefendOS provides a large number of predefined service
objects but administrator defined
custom services can also be
created. Existing service objects can also be collected together
into
service groups .
See Section 3.3, “Services” for more information about this topic.
An important principle to note is that usually all filtering criteria must match a data flow through
NetDefendOS for the rule to be applied. The
Service filter is particularly useful since it is possible
with this to target only a certain protocol such as HTTP or SMTP.
The NetDefendOS Security Policy Rule Sets
The principle NetDefendOS rule sets that define NetDefendOS security policies, and which use
the filtering parameters described above (networks/interfaces/service), include:
• IP Rules
IP Rule objects determine which traffic is permitted to pass through the NetDefend Firewall as
well as determining if the traffic is subject to address translation. The network filter for these
rules can be IPv4 or IPv6 addresses (but not both in a single rule). They are further described
Chapter 3: Fundamentals
228