•
Route #1
All packets going to hosts on the 192.168.0.0/24 network should be sent out on the lan interface.
As no gateway is specified for the route entry, the host is assumed to be located on the network
segment directly reachable from the lan interface.
•
Route #2
All packets going to hosts on the 10.4.0.0/16 network are to be sent out on the dmz interface.
Also for this route, no gateway is specified.
•
Route #3
All packets going to hosts on the 195.66.77.0/24 network will be sent out on the wan interface.
No gateway is required to reach the hosts.
•
Route #4
All packets going to any host (the all-nets network will match all hosts) will be sent out on the
wan interface and to the gateway with IP address 195.66.77.4. That gateway will then consult its
routing table to find out where to send the packets next.
A route with the destination all-nets is often referred to as the Default Route as it will match all
packets for which no specific route has been configured. This route usually specifies the
interface which is connected to the public internet.
When a routing table is evaluated, the ordering of the routes is important. In general, a routing table
is evaluated with the most specific routes first. In other words, if two routes have destination
networks that overlap, the narrower network definition will be evaluated prior to the wider one (in
other words, the network that is contained within the other has priority).
In the above example, a packet with a destination IP address of 192.168.0.4 will theoretically match
both the first route and the last one. However, the first route entry is a narrower, more specific
match so the evaluation will end there and the packet will be routed according to that entry.
The Local IP Address Parameter
The correct usage of the Local IP Address parameter can be difficult to understand so additional
explanation can be helpful.
Normally, a physical interface such as lan is connected to a single network and the interface and
network are on the same network. We can say that the network is bound to a physical interface and
clients on the connected network can automatically find the D-Link Firewall through ARP queries.
ARP works because the clients and the NetDefendOS interface are part of the same network.
A second network might then be added to the same physical interface via a switch, but with a new
network range that doesn't include the physical interface's IP address. We would say that this
network is not bound to the physical interface. Clients on this second network won't then be able to
communicate with the D-Link Firewall because ARP won't function between the clients and the
interface.
To solve this problem we would add a new route to NetDefendOS which would have the following
parameters:
•
Interface: The interface on which the second network is found.
•
Network: The IP address range of the second network.
•
Local IP Address: An address within the second network's IP range.
When the Default Gateway of the second network's clients is now set to the same value as the Local
4.2.1. The Principles of Routing
Chapter 4. Routing
125
Содержание 800 - DFL 800 - Security Appliance
Страница 24: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 24 ...
Страница 69: ...2 6 4 Restore to Factory Defaults Chapter 2 Management and Maintenance 69 ...
Страница 121: ...3 9 DNS Chapter 3 Fundamentals 121 ...
Страница 166: ...interfaces without an overriding IGMP Setting Default 1 000 4 6 4 Advanced IGMP Settings Chapter 4 Routing 166 ...
Страница 181: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 181 ...
Страница 192: ...5 5 IP Pools Chapter 5 DHCP Services 192 ...
Страница 282: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 282 ...
Страница 300: ...mechanism 7 3 7 SAT and FwdFast Rules Chapter 7 Address Translation 300 ...
Страница 301: ...7 3 7 SAT and FwdFast Rules Chapter 7 Address Translation 301 ...
Страница 303: ... Changed on a regular basis such as every three months 8 1 Overview Chapter 8 User Authentication 303 ...
Страница 318: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 318 ...
Страница 322: ...ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 322 ...
Страница 377: ...Management Interface Failure with VPN Chapter 9 VPN 377 ...
Страница 408: ...10 4 6 SLB_SAT Rules Chapter 10 Traffic Management 408 ...
Страница 419: ...11 5 HA Advanced Settings Chapter 11 High Availability 419 ...
Страница 426: ...12 3 5 Limitations Chapter 12 ZoneDefense 426 ...
Страница 449: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 449 ...