covered using a port definition specified as
135-139,445
.
HTTP and HTTPS can be covered by specifying destination
ports
80,443
.
Tip: Specifying source ports
It is usual with many services that the source ports are left as their default value which is
the range 0-65535 (corresponding to all possible source ports).
With certain application, it can be useful to also specify the source port if this is always
within a limited range of values. Making the service definition as narrow as possible is
the recommended approach.
Other Service Properties
Apart from the basic protocol and port information, TCP/UDP service objects also have several
other properties:
•
Forward ICMP Errors
If an attempt to open a TCP connection is made by a user application behind the NetDefend
Firewall and the remote server is not in operation, an ICMP error message is returned as the
response. Such ICMP messages are interpreted by NetDefendOS as new connections and will
be dropped unless an IP rule explicitly allows them.
The Allow ICMP errors for active connections property allows such ICMP messages to be
automatically passed back to the requesting application. In some cases, it is useful that the
ICMP messages are not dropped. For example, if an ICMP
quench
message is sent to reduce
the rate of traffic flow. On the other hand, dropping ICMP messages increases security by
preventing them being used as a means of attack.
•
Enable IPv4 Path MTU Discovery
This can be enabled only if the
Allow ICMP Errors
property is enabled and permits the relaying
of path MTU discovery ICMP messages. This feature is discussed further in
.
•
SYN Flood Protection
This option allows a TCP based service to be configured with protection against
SYN Flood
attacks. This option only exists for the
TCP/IP
service type.
For more details on how this feature works see
Section 6.7.8, “TCP SYN Flood Attacks”
.
•
ALG
A TCP/UDP service can be linked to an
Application Layer Gateway
(ALG) to enable deeper
inspection of certain protocols. This is the way that an ALG is associated with an IP rule. First,
associate the ALG with a service and then associate the service with an IP rule.
For more information on this topic see
•
Max Sessions
Chapter 3: Fundamentals
169
Summary of Contents for NetDefendOS
Page 30: ...Figure 1 3 Packet Flow Schematic Part III Chapter 1 NetDefendOS Overview 30 ...
Page 32: ...Chapter 1 NetDefendOS Overview 32 ...
Page 144: ...Chapter 2 Management and Maintenance 144 ...
Page 284: ...Chapter 3 Fundamentals 284 ...
Page 392: ...Chapter 4 Routing 392 ...
Page 419: ... Host 2001 DB8 1 MAC 00 90 12 13 14 15 5 Click OK Chapter 5 DHCP Services 419 ...
Page 420: ...Chapter 5 DHCP Services 420 ...
Page 573: ...Chapter 6 Security Mechanisms 573 ...
Page 607: ...Chapter 7 Address Translation 607 ...
Page 666: ...Chapter 8 User Authentication 666 ...
Page 775: ...Chapter 9 VPN 775 ...
Page 819: ...Chapter 10 Traffic Management 819 ...
Page 842: ...Chapter 11 High Availability 842 ...
Page 866: ...Default Enabled Chapter 13 Advanced Settings 866 ...
Page 879: ...Chapter 13 Advanced Settings 879 ...