Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Bypass
Force Allow
Deny
Allow
Log Only
It is important to remember that if you have a force allow rule and a deny rule at the same
priority the force allow rule takes precedence over the deny rule and therefore traffic matching the
force allow rule will be permitted.
Stateful Filtering
When stateful analysis is enabled, packets are analyzed within the context of traffic history, correctness of
TCP and IP header values, and TCP connection state transitions. In the case of stateless protocols (e.g.
UDP and ICMP) a pseudo-stateful mechanism is implemented based on historical traffic analysis.
A packet is passed through the stateful routine if it is explicitly allowed via static rules.
The packet is examined if it belongs to an existing connection by checking the connection table
for matching end points
The TCP header is examined for correctness (e.g. sequence numbers, flag combination)
Once enabled, the stateful engine is applied to all traffic traversing the interface.
UDP pseudo-stateful inspection, by default, rejects any incoming "unsolicited" UDP packets. If a Computer
is running a UDP server, a force allow rule must be included in the policy to permit access to that
service. For example, if UDP stateful inspection is enabled on a DNS server, a force allow rule permitting
UDP traffic to port 53 is required.
ICMP pseudo-stateful inspection, by default, rejects any incoming unsolicited ICMP request-reply and error
type packets. A force allow must be explicitly defined for any unsolicited ICMP packet to be allowed. All
other ICMP (non request-reply or error type) packets are dropped unless explicitly allowed with static
rules.
Putting it all together to design a Firewall Policy
Generally speaking, there are two approaches when defining a firewall policy for a Computer:
Prohibitive: That which is not expressly allowed, is prohibited. Prohibitive policies can be created
by using a combination of allow rules to describe allowed traffic and deny rules to further
restrict permitted traffic.
Permissive: That which is not expressly prohibited, is allowed. Permissive policies can be
created through the exclusive used of deny rules to describe the traffic that should be dropped.
In general, prohibitive policies are preferred and permissive policies should be avoided.
Force allow rules should only be used in conjunction with allow and deny rules to allow a subset of
traffic that has been prohibited by the allow and deny rules. Force allow rules are also required to allow
unsolicited ICMP and UDP traffic when ICMP and UDP stateful are enabled.
Example
Take the example of how a simple firewall policy can be created for a Web server.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 124 -