D-Link NetDefendOS, User Manual

Page: 805 / 912

the rule. If the Threshold Rule is linked to a service then it is possible to block only that service.
When blacklisting is selected, the administrator can choose to leave pre-existing connections
from the triggering source unaffected, or can alternatively choose to have the connections
dropped by NetDefendOS. The length of time, in seconds, for which the source is blacklisted can
also be set.
Example 10.3. Creating a Threshold Rule
This example will create a Threshold Rule object will drop connections that exceed more than 100
connections per second from a single source IP address. The rule will be applied to HTTP
connections from the Internet arriving on the wan interface.
In addition, when the threshold is exceeded, all HTTP traffic from the source IP will be blacklisted
for 5 minutes (300 seconds) and any existing connections from that IP will be dropped when the
theshold rule is triggered.
Here, the expectation is that a SAT rule would translate the destination address to the IP address
of a protected webserver.
Command-Line Interface
First create the threshold rule:
gw-world:/> add ThresholdRule
SourceInterface=wan
SourceNetwork=all-nets
DestinationInterface=core
DestinationNetwork=wan_ip
Service=http-all
Name=limit_dmz
Next, change the context to be the new rule and add a threshold action to it:
gw-world:/> cc ThresholdRule limit_dmz
gw-world:/1(limit_dmz)> add ThresholdAction
Threshold=100
ThresholdUnit=Conns
Action=Protect
GroupBy=SourceIP
BlackList=Yes
BlackListBlockOnlyService=Yes
BlackListTimeToBlock=300
BlackListIgnoreEstablished=No
Web Interface
First create the threshold rule:
1. Go to: Policies > Traffic Management > Threshold Rules > Add > Threshold Rule
2. Now enter:
• Name: limit_dmz
• Service: http-all
• Source Interface: wan
• Source Network: all_nets
Chapter 10: Traffic Management
805