User manual D-LINK DFL-2500

[. . . ] CONTENTS I Preface Document Version . . xvi xvii xvii xvii xviii II Product Overview 2 3 3 1 Capabilities 1. 1 Product Highlights . . III Introduction to Networking 6 7 9 9 9 9 10 11 11 11 13 13 14 2 The OSI Model 3 Firewall Principles 3. 1 The Role of the Firewall . 3. 2 What does a Firewall NOT protect against? [. . . ] When passive mode is used, the firewall does not need to allow connections from the FTP server. On the other hand, the firewall still does not know what port the FTP client tries to use for the data channel. This means that the firewall has to allow traffic from all ports on the FTP client to all ports on the FTP server. Although this is not as insecure as in the active mode case, it still presents a potential security threat. Furthermore, not all FTP clients are capable of using passive mode. Solution The FTP ALG solves this problem by fully reassembling the TCP stream of the command channel and examining its contents. Thus, the firewall knows what port to be opened for the data channel. Moreover, the FTP ALG also provides functionality to filter out certain control commands and provide a basic buffer overrun protection. The most important feature of the FTP ALG is its unique capability to perform on-the-fly conversion between active and passive mode. The conversion can be described like this: · The FTP client can be configured to use passive mode, which is the recommended mode for clients. · The FTP server can be configured to use active mode, which is the safer mode for servers. · When a FTP session is established, the firewall will automatically and transparently receive the passive data channel from the FTP client and the active data channel from the server, and tie them together. This implementation results in that both the FTP client and the FTP server work in their most secure mode. Naturally, the conversion also works the other way around, that is, with the FTP client using active mode and the FTP server using passive mode. D-Link Firewalls User's Guide 150 Chapter 18. Application Layer Gateway (ALG) 18. 2. 2 Scenarios: FTP ALG Configuration Example: Protecting a FTP Server Figure 18. 1: FTP ALG Scenario 1 In this example, a FTP Server is connected to a D-Link firewall on a DMZ with private IP addresses, shown in Figure 18. 1. To make it possible to connect to this server from the Internet using the FTP ALG, the FTP ALG and firewall rules should be configured as follows: WebUI : 1. ALG Objects - > Application Layer Gateways - > Add - > FTP ALG: General: Name: ftp-inbound Check Allow client to use active mode (unsafe for client). Uncheck Allow server to use passive mode (unsafe for server) Then click OK. D-Link Firewalls User's Guide 18. 2. Services Objects - > Services - > Add - > TCP/UDP Service: General: Enter the following: Name: ftp-inbound Type: select TCP from the dropdown list. Destination: 21 (the port the ftp server resides on). Application Layer Gateway: ALG: select "ftp-inbound" that has been created. Rules ­ Allow connections to the public IP on port 21 and forward that to the internal FTP server: Rules - > IP Rules - > Add - > IP Rule: General: Name: SAT-ftp-inbound Action: SAT Service: ftp-inbound Address Filter: Source Destination Interface: any core Network: all-nets ip-ext (assume the external interface has been defined as "ip-ext") SAT: Check Translate the Destination IP Address To: New IP Address: ftp-internal. [. . . ] dyndns registration, etc WWWSrv - Settings regarding the builtin web server HwPerformance - Hardware performance parameters IfaceMon - Interface Monitor RouteFailOver - Route Fail Over Default values IDS - Intrusion Detection / Prevention Settings PPP - PPP (L2TP/PPTP/PPPoE) Settings Misc - Miscellaneous Settings D-Link Firewalls User's Guide 336 Chapter A. Console Commands Reference -- settings <group name> Shows the settings of the specified group. Example: Cmd> settings arp ARP (Address Resolution ARPMatchEnetSender ARPQueryNoSenderIP ARPSenderIP UnsolicitedARPReplies ARPRequests ARPChanges StaticARPChanges ARPExpire ARPMulticast ARPBroadcast ARPCacheSize ARPHashSizeVLAN Protocol) Settings : DropLog : DropLog : Validate : DropLog : Drop : AcceptLog : DropLog : 900 ARPExpireUnknown : 3 : DropLog : DropLog : 4096 ARPHashSize : 512 : 64 Stats Shows various vital stats and counters. · Syntax: stats Example: Cmd> stats Uptime : . . . CPU Load :6 Connections : 4919 out of 32768 Fragments : 17 out of 1024 (17 lingering) Buffers allocated : 1252 Buffers memory : 1252 x 2292 = 2802 KB Fragbufs allocated : 16 Fragbufs memory : 16 x 10040 = 156 KB Out-of-buffers :0 ARP one-shot cache : Hits : 409979144 Misses : 186865338 Interfaces: Phys:2 VLAN:5 VPN:0 Access entries:18 Rule entries:75 Using configuration file "FWCore. cfg", ver . . . [. . . ]