PANEL_addRuleDlg

Adding Access Rules

To add a new access rule:

  1. Go to Firewall > Access Rules.
  2. Click the Add button.
    The Add Rule dialog appears.




  3. In the General tab, under Settings, select Action: Allow, Deny, or Discard.
  4. In the From Zone menu, select the zone you want.
  5. In the To Zone menu, select the zone you want.
  6. In the Service menu, select the service or group of services affected by the access rule from the Service list.

    7. Note: The Default service encompasses all IP services. If the service is not listed, you must define the service in the Add Service window. Select Create New Service or Create New Group to display the Add Service window or Add Service Group window.

  7. In the Source menu, select the source of the traffic affected by the access rule.
    Selecting Create New Network displays the Add Address Object window.
  8. In the Destination menu, select the destination of the traffic affected by the access rule from the Source list. Selecting Create New Network displays the Add Address Object window.
  9. In the Users Included menu, select the user or user group to be affected by the access rule.
  10. In the Users Excluded menu, select the user or user group not to be affected by the access rule.

    11. Note: If this is an Allow Access Rule, Users Included are allowed access by the access rule. Users Excluded are not allowed access by the access rule.

    Note: If this is an Deny or Discard Access Rule, Users Included are denied access by the access rule. Users Excluded are not denied access by the access rule.

  11. In the Schedule menu, select a schedule. The default schedule is Always on.
  12. In the Comments field, enter any comments to help identify the access rule.
  13. If you want to enable the logging of the service activities, select the Enable Logging checkbox.
  14. The Allow Fragmented Packets checkbox is enabled by default.

    15. Note: Large IP packets are often divided into fragments before they are routed over the Internet and then reassembled at a destination host. One reason to disable this setting is because it is possible to exploit IP fragmentation in Denial of Service (DoS) attacks.

  15. If you want to enable flows matching this access rule to be displayed in the AppFlow Monitor and AppFlow Reports pages, select the Enable flow reporting checkbox.
  16. If you want to enable flows matching this access rule to be displayed in the Packet Monitor page, select the Enable Packet Monitor checkbox.
  17. Click on the Advanced tab.
  18. If you would like for the access rule to timeout after a period of TCP inactivity, set the amount of time, in minutes, in the TCP Connection Inactivity Timeout (minutes) field. The default value is 5 minutes.
  19. If you would like for the access rule to timeout after a period of UDP inactivity, set the amount of time, in minutes, in the UDP Connection Inactivity Timeout (minutes) field. The default value is 30 minutes.
  20. Specify the number of connections allowed as a percent of maximum number of connections allowed by the firewall in the Number of connections allowed (% of maximum connections) field. Refer to Connection Limiting Overview for more information on connection limiting.
  21. Click the Enable connection limit for each Source IP Address checkbox to define a threshhold for dropped packets. When this threshold is exceeded, connections and packets from the corresponding Source IP are dropped.
  22. Click the Enable connection limit for each Destination IP Address checkbox to define a threshhold for dropped packets. When this threshold is exceeded, connections and packets from the corresponding Destination IP are dropped.
  23. Select Create a reflexive rule if you want to create a matching access rule to this one in the opposite direction--from your destination zone or address object to your source zone or address object.
  24. Click on the QoS tab if you want to apply DSCP or 802.1p Quality of Service management to traffic governed by this rule. See 802.1p and DSCP QoS for more information on managing QoS marking in access rules.
  25. Under DSCP Marking Settings select the DSCP Marking Action. You can select None, Preserve, Explicit, or Map. Preserve is the default.
  26. Under 802.1p Marking Settings select the 802.1p Marking Action. You can select None, Preserve, Explicit, or Map. None is the default.
  27. Click on the Ethernet BWM tab if you want to apply outbound or inbound BWM traffic allow rules.




    28. Tip: Do not configure bandwidth management on multiple interfaces on a zone, where the configured guaranteed bandwidth for the zone is greater than the available bandwidth for the bound interface. For more information on Bandwidth Management see Bandwidth Management.

  28. Click OK to add the rule.

Tip: Although custom access rules can be created that allow inbound IP traffic, the firewall does not disable protection from DoS attacks, such as the SYN Flood and Ping of Death attacks.

Editing an Access Rule





To display the Edit Rule window (includes the same settings as the Add Rule window), click the Edit icon.

Deleting an Access Rule





To delete the individual access rule, click on the Delete icon. To delete all the checkbox selected access rules, click the Delete button.

Restoring Access Rules to Default Zone Settings

To remove all end-user configured access rules for a zone, click the Default button. This will restore the access rules for the selected zone to the default access rules initially setup on the Dell SonicWALL network security appliance.

Displaying Access Rule Traffic Statistics

Move your mouse pointer over the Graph icon to display the following access rule receive (Rx) and transmit (Tx) traffic statistics:

Connection Limiting Overview

The Connection Limiting feature is intended to offer an additional layer of security and control when coupled with such SonicOS features as SYN Cookies and Intrusion Prevention Services (IPS). Connection limiting provides a means of throttling connections through the firewall using Access Rules as a classifier, and declaring the maximum percentage of the total available connection cache that can be allocated to that class of traffic.

Coupled with IPS, this can be used to mitigate the spread of a certain class of malware as exemplified by Sasser, Blaster, and Nimda. These worms propagate by initiating connections to random addresses at atypically high rates. For example, each host infected with Nimda attempted 300 to 400 connections per second, Blaster sent 850 packets per second, and Sasser was capable of 5,120 attempts per second. Typical, non-malicious network traffic generally does not establish anywhere near these numbers, particularly when it is Trusted ->Untrusted traffic (i.e. LAN->WAN). Malicious activity of this sort can consume all available connection-cache resources in a matter of seconds, particularly on smaller appliances.

The following table delineates the connection-cache size of Dell SonicWALL network security appliances running SonicOS with UTM security services enabled or disabled (numbers are subject to change):

Dell SonicWALL Network Security Appliance Connection Cache Maximum Full UTM No UTM

10100

500,000

1,000,000

10200

500,000

1,000,000

10300

500,000

1,000,000

10400

500,000

1,000,000

In addition to mitigating the propagation of worms and viruses, Connection limiting can be used to alleviate other types of connection-cache resource consumption issues, such as those posed by uncompromised internal hosts running peer-to-peer software (assuming IPS is configured to allow these services), or internal or external hosts using packet generators or scanning tools.

Finally, connection limiting can be used to protect publicly available servers (such as, Web servers) by limiting the number of legitimate inbound connections permitted to the server (i.e. to protect the server against the Slashdot-effect). This is different from SYN flood protection which attempts to detect and prevent partially-open or spoofed TCP connection. This will be most applicable for Untrusted traffic, but it can be applied to any zone traffic as needed.

Connection limiting is applied by defining a percentage of the total maximum allowable connections that may be allocated to a particular type of traffic. The above figures show the default LAN ->WAN setting, where all available resources may be allocated to LAN->WAN (any source, any destination, any service) traffic.

More specific rules can be constructed; for example, to limit the percentage of connections that can be consumed by a certain type of traffic (e.g. FTP traffic to any destination on the WAN), or to prioritize important traffic (e.g. HTTPS traffic to a critical server) by allowing 100% to that class of traffic, and limiting general traffic to a smaller percentage (minimum allowable value is 1%).

Note: It is not possible to use IPS signatures as a connection limiting classifier; only Access Rules (for example, Address Objects and Service Objects) are permissible.

Access Rule Configuration Examples

This section provides configuration examples on adding network access rules:

Enabling Ping

This section provides a configuration example for an access rule to allow devices on the DMZ to send ping requests and receive ping responses from devices on the LAN. By default your Dell SonicWALL network security appliance does not allow traffic initiated from the DMZ to reach the LAN. Once you have placed one of your interfaces into the DMZ zone, then from the Firewall > Access Rules window, perform the following steps to configure an access rule that allow devices in the DMZ to send ping requests and receive ping responses from devices in the LAN.

  1. Click Add to launch the Add Rule window.
  2. Select the Allow radio button.
  3. From the Service menu, select Ping.
  4. From the Source menu, select DMZ Subnets.
  5. From the Destination menu, select LAN Subnets.
  6. Click OK.

Blocking LAN Access for Specific Services

This section provides a configuration example for an access rule blocking LAN access to NNTP servers on the Internet during business hours.

Perform the following steps to configure an access rule blocking LAN access to NNTP servers based on a schedule:

  1. Click Add to launch the Add window.
  2. Select Deny from the Action settings.
  3. Select NNTP from the Service menu. If the service is not listed in the list, you must to add it in the Add Service window.
  4. Select Any from the Source menu.
  5. Select WAN from the Destination menu.
  6. Select the schedule from the Schedule menu.
  7. Enter any comments in the Comment field.
  8. Click Add.

Allowing WAN Primary IP Access from the LAN Zone

By creating an access rule, it is possible to allow access to a management IP address in one zone from a different zone on the same firewall. For example, you can allow HTTP/HTTPS management or ping to the WAN IP address from the LAN side. To do this, you must create an access rule to allow the relevant service between the zones, giving one or more explicit management IP addresses as the destination. Alternatively, you can provide an address group that includes single or multiple management addresses (such as, WAN Primary IP, All WAN IP, All X1 Management IP) as the destination. This type of rule allows the HTTP Management, HTTPS Management, SSH Management, Ping, and SNMP services between zones.

Note: Access rules can only be set for inter-zone management. Intra-zone management is controlled per-interface by settings in the interface configuration

To create a rule that allows access to the WAN Primary IP from the LAN zone:

  1. On the Firewall > Access Rules page, display the LAN > WAN access rules.
  2. Click Add to launch the Add window.
  3. Select Allow from the Action settings.
  4. Select one of the following services from the Service menu:
  5. Select Any from the Source menu.
  6. Select an address group or address object containing one or more explicit WAN IP addresses from the Destination menu.

    7. Note: Do not select an address group or object representing a subnet, such as WAN Primary Subnet. This would allow access to devices on the WAN subnet (already allowed by default), but not to the WAN management IP address.

  7. Select the user or group to have access from the Users Allowed menu.
  8. Select the schedule from the Schedule menu.
  9. Enter any comments in the Comment field.
  10. Click Add.