Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Bypass Rule
There is a special type of Firewall Rule called a Bypass Rule. It is designed for media intensive protocols
where filtering may not be desired. You create a Bypass Rule by selecting "bypass" as the rule's "Action"
when creating a new Firewall Rule.
The "Bypass" action on Firewall Rules differs from a Force Allow rule in the following ways:
1. Packets matching Bypass will not be processed by DPI Rules
2. Unlike Force Allow, Bypass will not automatically allow the responses on a TCP connection when
Stateful Configuration is on (See below for more information)
3. Some Bypass rules are optimized, in that traffic will flow as efficiently as if our client plug-in was
not there (See below for more information)
Important: When a Bypass Firewall Rule is sent to a Client Plug-in older than version 5.0, it will
be treated as a Force Allow, which will not skip DPI Rule processing.
Using Bypass when Stateful Configuration is On
If you plan to use a Bypass Rule to skip DPI Rule processing on incoming traffic to TCP destination port N
and Stateful Configuration is set to perform stateful inspection on TCP, you must create a matching
outgoing rule for source port N to allow the TCP responses. (This is not required for Force Allow rules
because force-allowed traffic is still processed by the stateful engine.)
All Bypass rules are unidirectional. Explicit rules are required for each direction of traffic.
Optimization
The Bypass Rule is designed to allow matching traffic through at the fastest possible rate. Maximum
throughput can be achieved with (all) the following settings:
1. Priority: Highest
2. Frame Type: IP
3. Protocol: TCP, UDP, or other IP protocol. (Do not use the "Any" option.)
4. Source and Destination IP and MAC: all "Any"
5. If the protocol is TCP or UDP and the traffic direction is "incoming", the Destination Ports must be
one or more specified ports (not "Any"), and the Source Ports must be "Any".
6. If the protocol is TCP or UDP and the traffic direction is "outgoing", the Source Ports must be one
or more specified ports (Not "Any"), and the Destination Ports must be "Any".
7. Schedule: None.
Logging
Packets that match the bypass rule will not be logged. This is not a configurable option.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 130 -