Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Creating and Applying New Firewall
Rules
Firewall Rules are composed of four basic elements:
Action: whether the Client Plug-in will allow packets matching the rule's criteria through
regardless of any other rules that would block them ("force allow"); block packets matching the
rule's criteria ("deny"); exclusively allow only packets matching the rule's criteria and block all
others ("Allow"); or log packets matching the rule's criteria and let them pass ("log only"). Within
a priority level (see next item), rules are applied in this order:
1. "bypass"
2. "force allow"
3. "deny"
4. "allow"
5. "log only"
Priority: Firewall Rules can have a priority of 0 (lowest) to 4 (highest). High priority rules are
applied first.
Packet Direction: whether the packet is incoming or outgoing.
Packet Source: all the information that describes the packet's source (frame type, protocol, IPs,
ports, flags, etc.)
Packet Destination: all the information that describes the packet's destination (frame type,
protocol, IPs, ports, flags, etc.)
Specific Flags: which particular to flags have to be set for the rule to trigger. (Flags will vary
depending on protocol.)
To create a new Firewall Rule:
1. Go to the Firewall Rules screen and click New on the toolbar.
2. Type a name and description for your new Firewall Rule.
3. Select a rule action, priority, and packet direction from the drop-down lists.
4. Define the criteria that this rule will look for in the packets' control information. (Note that as well
as inclusive criteria, you can define exclusive criteria by checking the "Not" checkbox at the right
of each option.)
5. Click the Options tab and select whether you want the rule to only be active during certain
scheduled periods. Specify whether you want this rule to trigger an alert when it is triggered.
6. Click OK to close the New Firewall Rule Window.
Now you have to assign the new Firewall Rule to a Computer. The best way to manage the application of
Firewall Rules to Computers is by way of Security Profiles. Having a Security Profile called "Developer
Laptop", for example, allows you to create a set of Firewall Rules all designed for the particular
environment "developer laptops" operate in. You can then assign them all to the "Developer Laptop"
Security Profile, and then assign that Security Profile to that collection of Computers. Anytime you need to
create and assign a new Firewall Rule to your "developer laptops", you just assign it to the Security
Profile, and all "Developer Laptop" Computers will be updated with the new Firewall Rule.
To include a new Firewall Rule in a Security Profile:
1. Go to the Security Profiles screen and double-click the Security Profile to which you want to
assign a new rule. This will open the Profile's Details window.
2. Click the Firewall Rules tab.
3. Find your new Firewall Rule in the list and put a check in its checkbox.
4. Click OK.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 131 -