Security |
 |
|
LAN DMZ Rules |
This page allows you to create firewall rules that define the movement of traffic
between the LAN and the DMZ. |
Default Inbound Policy |
All Inbound traffic to the LAN is blocked by default. To allow computers from
the DMZ network to access services on the LAN, a firewall rule for each service
needs to be added. |
Default Outbound Policy |
All Outbound traffic is blocked by default. To allow computers from
the LAN network to access services on the DMZ, a firewall rule for each service
needs to be added. |
Outbound Services |
This table lists the existing rules for outgoing traffic. A rule is defined by
the following fields: |
! (Status): A rule can be disabled if not in use
and enabled as needed. A rule is disabled if the status light is grey and it is
enabled if the status light is green. Disabling a rule does not delete the
configuration, but merely de-activates the rule. |
Service Name: This is a unique name assigned to the
service. The name usually indicates the type of traffic the rule covers such
ftp, ssh, telnet, ping, etc. Services not already in the list can be added on
the
Services page under the
Security menu. |
Filter: Defines an action to be taken on the
enabled rule. It can be: |
v |
Block Always: Block selected service at all times. |
v |
Allow Always: Allow selected service to pass
through at all times. |
v |
Block by schedule, otherwise allow: Works in
conjunction with a schedule defined in the
Schedule 1/2/3 pages. The selected
service will be blocked during the schedule interval and will be allowed to pass
through at other times. |
v |
Allow by schedule, otherwise block: Works in
conjunction with a schedule defined in the
Schedule 1/2/3 pages. The selected
service will be allowed to pass through during the scheduled interval and will
be blocked at other times. |
|
LAN Users: Specifies whether one or more IP
Addresses on the LAN will be affected by the rule. This rule will affect packets
for the selected service from the defined IP address or range of IP addresses on
the LAN side. |
v |
Any: All computers on the LAN will be affected by
in the rule. |
v |
Single Address: A single LAN IP address will be
affected by the rule. |
v |
Address Range: A range of LAN IP addresses will be
affected by the rule. |
v |
Group: Computers that are part of the Group defined
in the Network Database will be affected by the rule (groups are defined under
the
Network Configuration men,
LAN Groups page,
Edit Group Names link) |
|
DMZ Users: Specifies whether all DMZ addresses or
specific IP addresses are included in the rule. |
v |
Any: All IP addresses on the DMZ will be affected
by the rule. |
v |
Single Address: A single DMZ IP address will be
affected by the rule. |
v |
Address Range: A range of IP addresses on the DMZ
network will be affected by the rule. |
|
Priority: The priority assigned to IP packets of
this service. The priorities are defined by “Type of Service (TOS) in the
Internet Protocol Suite” standards, RFC 1349. The router marks the Type Of Service (TOS) field as defined below: |
v |
Normal-Service: No special priority given to the traffic. The IP packets for services with this priority are marked with a TOS value of 0. |
v |
Minimize-Cost: Used when data must be transferred over a link that has a lower "cost". The IP packets for services with this priority are marked with a TOS value of 1.
|
v |
Maximize-Reliability: Used when data needs to travel to the destination over a reliable link and with little or no retransmission. The IP packets for services with this priority are marked with a TOS value of 2.
|
v |
Maximize-Throughput: Used when the volume of data transferred during an interval is important even if the latency over the link is high. The IP packets for services with this priority are marked with a TOS value of 4. |
v |
Minimize-Delay: Used when the time required (latency) for the packet to reach the destination must be low. The IP packets for services with this priority are marked with a TOS value of 8. |
|
Log: Specifies whether the packets for this rule
should be logged or not. To log details for all packets that match this rule,
select
Always. Select
Never to disable logging.
For example, if an outbound rule for a schedule is selected as
Block Always, then for every packet that tries to
make an outbound connection for that service, a message with the packet’s source
address and destination address (and other information) will be recorded in the
log. Enabling logging may generate a significant volume of log messages and is
recommended for debugging purposes only. |
The actions that can be taken on rules are: |
Edit: Modifies the configuration of the selected
rule. |
Select All: Select all the rules in the table. |
Delete: Deletes the selected policy or policies. |
Enable: Select the checkbox next to one or more
rules listed in the table and click
Enable to enable the rule. |
Disable: Select the checkbox next to one or more
rules listed in the table and click
Disable to disable a rule. |
Add: Adds a new rule. |
Inbound Services |
This table lists all the existing rules for incoming traffic. A rule is defined
by the following fields: |
! (Status): A rule can be disabled if not in use
and enabled as needed. A rule is disabled if the status light is grey and it is
enabled if the status light is green. Disabling a rule does not delete the
configuration, but merely de-activates the rule. |
Service Name: This is a unique name assigned to the
service. The name usually indicates the type of traffic the rule covers such
ftp, ssh, telnet, ping, etc. Services not already in the list can be are added
on the
Services page under the
Security menu. |
Filter: Defines an action to be taken on the
enabled rule. It can be: |
v |
Block Always: Block selected service at all times. |
v |
Allow Always: Allow selected service to pass
through at all times. |
v |
Block by schedule, otherwise allow: Works in
conjunction with a schedule defined in the
Schedule 1/2/3 pages. The selected service will be
blocked during the scheduled interval and will be allowed to pass through at
other times. |
v |
Allow by schedule, otherwise block: Works in
conjunction with a schedule defined in the
Schedule 1/2/3 pages. The selected service will be
allowed to pass through during the scheduled interval and will be blocked at
other times. |
|
LAN Users: Specifies whether one of more IP
addresses on the LAN will be affected by the rule. The rule will affect packets
for the selected service from the defined IP address or range of IP addresses on
the LAN side. |
v |
Any: All computers on the LAN will be affected by
the rule. |
v |
Single Address: A single LAN IP address will be
affected by the rule. |
v |
Address Range: A range of LAN IP addresses will be
affected by the rule. |
v |
Group: Computers that are part of the Group defined
in the Network Database will be affected by the rule (groups are defined under
the Network Configuration menu, LAN Groups page, Edit Group Names link). |
|
DMZ Users: Specifies whether one or more IP
addresses on the DMZ network will be affected by the rule. This rule will affect
packets for the selected service to the defined IP address or range of IP
addresses on the DMZ network. |
v |
Any: All IP addresses on the DMZ network will be
affected by the rule. |
v |
Single Address: A single DMZ IP address will be
affected by the rule. |
v |
Address Range: A range of DMZ IP addresses will be
affected by the rule. |
|
Priority: The priority assigned to IP packets of
this service. The priorities are defined by “Type of Service (TOS) in the
Internet Protocol Suite” standards, RFC 1349. The router marks the Type Of Service (TOS) field as defined below: |
v |
Normal-Service: No special priority given to the traffic. The IP packets for services with this priority are marked with a TOS value of 0. |
v |
Minimize-Cost: Used when data must be transferred over a link that has a lower "cost". The IP packets for services with this priority are marked with a TOS value of 1.
|
v |
Maximize-Reliability: Used when data needs to travel to the destination over a reliable link and with little or no retransmission. The IP packets for services with this priority are marked with a TOS value of 2.
|
v |
Maximize-Throughput: Used when the volume of data transferred during an interval is important even if the latency over the link is high. The IP packets for services with this priority are marked with a TOS value of 4. |
v |
Minimize-Delay: Used when the time required (latency) for the packet to reach the destination must be low. The IP packets for services with this priority are marked with a TOS value of 8. |
|
Log: Specifies whether the packets for this rule
should be logged or not. To log details for all packets that match this rule,
select
Always. Select
Never to disable logging.
For example, if an outbound rule for a schedule is selected as
Block Always, then for every packet that tries to
make an outbound connection for that service, a message with the packet’s source
address and destination address (and other information) will be recorded in the
log. Enabling logging may generate a significant volume of log messages and is
recommended for debugging purposes only. |
The actions that can be taken on the rules listed in the table are: |
Edit: Modifies the configuration of the selected
rule. |
Select All: Selects all the rules in the table. |
Delete: Deletes the selected policy or policie. |
Enable: Check the radio box next to one or more
rules listed in the table and click
Enable to enable the rule. |
Disable: Check the radio box next to one or more
rules listed in the table and click
Disable to disable a rule. |
Add: Adds a new rule. |
|