D-Link NetDefend DFL-1660, Руководство пользователя

Страница: 104 / 595

to refer to all protocols. However, using this is not recommended and specifying a narrower service
provides better security.
If, for example, the requirement is only to filter using the principal protocols of TCP, UDP and
ICMP then the service group all_tcpudpicmp can be used instead.
Tip: The http-all service does not include DNS
A common mistake is to assume that the predefined service http-all includes the DNS
protocol. It does not so the predefined service dns-all is usually also required for most
web surfing. This could be included in a group with http-all and then associated with
the IP rules that allow web surfing.
Restrict Services to the Minimum Necessary
When choosing a service object to construct a policy such as an IP rule, the protocols included in
that object should be as few as necessary to achieve the traffic filtering objective. Using the
all_services object may be convenient but removes any security benefits that a more specific service
object could provide.
The best approach is to narrow the service filter in a security policy so it allows only the protocols
that are absolutely necessary. The all_tcpudpicmp service object is often a first choice for general
traffic but even this may allow many more protocols than are normally necessary and the
administrator can often narrow the range of allowed protocols further.
Example 3.13. Creating a Custom TCP/UDP Service
This example shows how to add a TCP/UDP service, using destination port 3306, which is used by MySQL:
Command-Line Interface
gw-world:/> add Service ServiceTCPUDP MySQL
DestinationPorts=3306
Type=TCP
Web Interface
1. Go to: Objects > Services > Add > TCP/UDP service
2. Specify a suitable name for the service, for example MySQL
3. Now enter:
• Type: TCP
• Source: 0-65535
• Destination: 3306
4. Click OK
3.3.3. ICMP Services
Another type of custom service that can be created is an ICMP Service.
The Internet Control Message Protocol (ICMP) is a protocol that is integrated with IP for error
reporting and transmitting control information. For example, the ICMP Ping feature uses ICMP to
test Internet connectivity.
3.3.3. ICMP Services Chapter 3. Fundamentals
104