D-Link NetDefend SOHO DFL-160, Руководство пользователя

Страница: 17 / 130

of time is fixed. After automatic logout occurs, the next interaction with the management web
interface will take the browser to the login page.
Connecting to the Internet
In the typical DFL-160 installation the next step is to connect to the public Internet. To do this the
WAN interface should be connected to your Internet Service Provider (ISP). This is usually done
through other equipment such as a broadband modem.
The WAN interface is, by default, configured to use DHCP to automatically fetch the required
external IP addresses from the ISP. If required, detailed WAN interface configuration is done by
going to the System > Internet Connection menu (these options are described in Section 3.2,
“Internet Connection”).
Once a connection to the Internet is established, web surfing from clients on networks attached to
the LAN interfaces is then possible. This is not possible with the DMZ interface since connections
on that interface are blocked until they are explicitly allowed.
Setting Firewall Security Policies
A key feature of the DFL-160 product is the ability to act as a firewall and impose security policies
on what kinds of traffic can flow between interfaces and in what direction.
As a next step, it is recommended to go to the Firewall > Outbound LAN Traffic menu and decide
what kinds of traffic can be initiated by internal hosts and users (these options are described in
Section 4.1, “Outbound LAN Traffic Options”).
By default, everything is allowed for outbound connections on the LAN interface but it is
recommended to restrict this to the minimum necessary. For instance, allowing the HTTP and
HTTPS services may be sufficient for web surfing.
A corresponding set of firewall options exists for the DMZ interface (see Section 4.2, “Outbound
DMZ Traffic Options”) but on initial setup, no outbound traffic is allowed on this interface so
services must be explicitly allowed.
The Meaning of "Outbound"
Keep in mind that the term outbound refers to traffic that is initiated from "inside", behind the
DFL-160 (in other words, from hosts and clients connected to the LAN or DMZ interface). All web
surfing traffic, no matter if it is a server request from a client or the reply to that request, is
considered to be outbound (this point will be repeated later in the manual). Conversely, inbound
traffic is exchanges that are initiated from the "outside", on the public Internet.
Using the DMZ for Management
By default, the DMZ interface is allocated the IP address 192.168.11.1 on the 192.168.11.0/24
network. However, the DMZ interface can't be used for initial connection with a browser because it
is not enabled as a management interface.
Management access through the DMZ interface can be enabled after initial management connection
through the LAN interface.
Going Further
At this point the DFL-160 product should be operational and acting as a secure barrier between
internal networks and the public Internet. The next step for the administrator is to further explore the
2.2. Web Browser Connection Chapter 2. Initial Setup
17