D-Link DFL-1600 Benutzerhandbuch
NetDefendOS May Also Need Internet Access
The NetDefend Firewall also needs to find the public Internet if it is to perform NetDefendOS
functions such as DNS lookup, Web Content Filtering or Anti-Virus and IDP updating. To allow
this, individual "normal" non-switch routes need to be set up in the routing table for each IP address
specifying the interface which leads to the ISP and the ISPs gateway IP address.
functions such as DNS lookup, Web Content Filtering or Anti-Virus and IDP updating. To allow
this, individual "normal" non-switch routes need to be set up in the routing table for each IP address
specifying the interface which leads to the ISP and the ISPs gateway IP address.
If the IP addresses that need to be reached by NetDefendOS are 85.12.184.39 and 194.142.215.15
then the complete routing table for the above example would be:
then the complete routing table for the above example would be:
Route type
Interface
Destination
Gateway
Switch
if1
all-nets
Switch
if2
all-nets
Non-switch
if1
85.12.184.39
gw-ip
Non-switch
if1
194.142.215.15
gw-ip
The appropriate IP rules will also need to be added to the IP rule set to allow Internet access through
the NetDefend Firewall.
the NetDefend Firewall.
Grouping IP Addresses
It can be quicker when dealing with many IP addresses to group all the addresses into a single group
IP object and then use that object in a single defined route. In the above example, 85.12.184.39 and
194.142.215.15 could be grouped into a single object in this way.
IP object and then use that object in a single defined route. In the above example, 85.12.184.39 and
194.142.215.15 could be grouped into a single object in this way.
Using NAT
NAT should not be enabled for NetDefendOS in Transparent Mode since, as explained previously,
the NetDefend Firewall is acting like a level 2 switch and address translation is done at the higher IP
OSI layer.
the NetDefend Firewall is acting like a level 2 switch and address translation is done at the higher IP
OSI layer.
The other consequence of not using NAT is that IP addresses of users accessing the Internet usually
need to be public IP addresses.
need to be public IP addresses.
If NATing needs to be performed in the example above to hide individual addresses from the
Internet, it would have to be done by a device (possibly another NetDefend Firewall) between the
192.168.10.0/24 network and the public Internet. In this case, internal IP addresses could be used by
the users on Ethernet network pn2.
Internet, it would have to be done by a device (possibly another NetDefend Firewall) between the
192.168.10.0/24 network and the public Internet. In this case, internal IP addresses could be used by
the users on Ethernet network pn2.
4.7.3. Transparent Mode Scenarios
Scenario 1
The firewall in Transparent Mode is placed between an Internet access router and the internal
network. The router is used to share the Internet connection with a single public IP address. The
internal NATed network behind the firewall is in the 10.0.0.0/24 address space. Clients on the
internal network are allowed to access the Internet via the HTTP protocol.
network. The router is used to share the Internet connection with a single public IP address. The
internal NATed network behind the firewall is in the 10.0.0.0/24 address space. Clients on the
internal network are allowed to access the Internet via the HTTP protocol.
4.7.3. Transparent Mode Scenarios
Chapter 4. Routing
218