D-Link NetDefendOS, User Manual

Page: 778 / 912

Pipes
A Pipe is the fundamental object for traffic shaping and is a conceptual channel through which
data traffic can flow. It has various characteristics that define how traffic passing through it is
handled. As many pipes as are required can be defined by the administrator. None are defined by
default.
Pipes are simplistic in that they do not care about the types of traffic that pass through them nor
the direction of that traffic. They simply measure the aggregate data that passes through them
and then apply the administrator configured limits for the pipe as a whole or for
Precedences
and/or Groups (these concepts are explained later in Section 10.1.6, “Precedences” ).
NetDefendOS is capable of handling hundreds of pipes simultaneously, but in reality most
scenarios require only a handful of pipes. It is possible that dozens of pipes might be needed in
scenarios where individual pipes are used for individual protocols. Large numbers of pipes might
also be needed in an ISP scenario where individual pipes are allocated to each client.
Pipe Rules
One or more Pipe Rules make up the NetDefendOS Pipe Rule set which determine what traffic will
flow through which pipes.
Each pipe rule is defined like other NetDefendOS security policies: by specifying both the source
and destination for the interface and network, as well as the service to which the rule is to apply.
Once a new connection is permitted by the IP rule set, the pipe rule set is then checked for any
matching pipe rules.
Pipe rules are checked in the same way as IP rules, by going from top to bottom (first to last) in
the rule set. The first matching rule, if any, decides if the connection is subject to traffic shaping.
Keep in mind that any connection that does not trigger a pipe rule will not be subject to traffic
shaping and could potentially use as much bandwidth as it wants.
Note: No pipe rules are defined by default
The rule set for pipe rules is initially empty with no rules being defined by default. At least
one rule must be created for traffic shaping to begin to function.
Pipe Rule Chains
When a pipe rule is defined, the pipes to be used with that rule are also specified and they are
placed into one of two lists in the pipe rule. These lists are:
• The Forward Chain
These are the pipe or pipes that will be used for outgoing (leaving) traffic from the NetDefend
Firewall. One, none or a series of pipes may be specified.
• The Return Chain
These are the pipe or pipes that will be used for incoming (arriving) traffic. One, none or a
series of pipes may be specified.
Chapter 10: Traffic Management
778