Chapter 48: Configuring Advanced Access Rule Settings

Firewall Settings > Advanced

To configure advanced access rule options, select Firewall Settings > Advanced under Firewall.





The Firewall Settings > Advanced page includes the following firewall configuration option groups:

Detection Prevention

Dynamic Ports

To illustrate how this feature works, consider the following example of an FTP server behind the SonicWALL listening on port 2121:

  1. On the Network > Address Objects page, create an Address Object for the private IP address of the FTP server with the following values:
  2. On the Network > Services page, create a custom Service for the FTP Server with the following values:
  3. On the Network > NAT Policies page, create the following NAT Policy, and on the Firewall Settings > Advanced page, create the following Access Rule




  4. Lastly, on the Firewall Settings > Advanced page, for the Enable FTP Transformations for TCP port(s) in Service Object select the FTP Custom Port Control Service Object.

The following options are also configured in the Dynamic Ports section of the Firewall Settings > Advanced page:

Source Routed Packets

Drop Source Routed Packets - (Enabled by default.) Clear this check box if you are testing traffic between two specific hosts and you are using source routing.

Connections

The Connections section provides the ability to fine-tune the performance of the appliance to prioritize either optimal performance or support for an increased number of simultaneous connections that are inspected by UTM services. There is no change in the level of security protection provided by either of the DPI Connections settings below. The following connection options are available:

Note: When changing the Connections setting, the SonicWALL security appliance must be restarted for the change to be implemented.





The maximum number of connections also depends on whether App Flow is enabled and if an external collector is configured, as well as the physical capabilities of the particular model of SonicWALL security appliance. Mousing over the question mark icon next to the Connections heading displays a pop-up table of the maximum number of connections for your specific SonicWALL security appliance for the various configuration permutations. The table entry for your current configuration is indicated in the table, as shown in the example below.





Access Rule Service Options

Force inbound and outbound FTP data connections to use default port 20 - The default configuration allows FTP connections from port 20 but remaps outbound traffic to a port such as 1024. If the check box is selected, any FTP data connection through the security appliance must come from port 20 or the connection is dropped. The event is then logged as a log event on the security appliance.

Apply firewall rules for intra-LAN traffic to/from the same interface - Applies firewall rules that is received on a LAN interface and that is destined for the same LAN interface. Typically, this only necessary when secondary LAN subnets are configured.

IP and UDP Checksum Enforcement

UDP

Default UDP Connection Timeout (seconds) - Enter the number of seconds of idle time you want to allow before UDP connections time out. This value is overridden by the UDP Connection timeout you set for individual rules.

Connection Limiting

The Connection Limiting feature provides an additional layer of security against distributed denial of service (DDoS) attacks by limiting the number of connections that can be initiated from or to individual IP addresses.





In addition to these configurable settings for individual IP addresses, all SonicWALL security appliances have a built-in limit on the total number of connections allowed. For more information on this feature, see Connection Limiting Overview.