Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Firewall Rule Sequence
Packets arriving at a Computer running a IDF Client Plug-in get processed first by Firewall Rules, then the
Stateful Configuration conditions, and finally by the DPI Rules.
This is the order in which Firewall Rules are applied (incoming and outgoing):
1. Firewall Rules with priority 4 (highest)
1. Bypass
2. Log Only (Note that Log Only rules can only be assigned a priority of 4 (highest))
3. Force Allow
4. Deny
2. Firewall Rules with priority 3 (high)
1. Bypass
2. Force Allow
3. Deny
3. Firewall Rules with priority 2 (normal)
1. Bypass
2. Force Allow
3. Deny
4. Firewall Rules with priority 1 (low)
1. Bypass
2. Force Allow
3. Deny
5. Firewall Rules with priority 0 (lowest)
1. Bypass
2. Force Allow
3. Deny
4. Allow (Note that an Allow rule can only be assigned a priority of 0 (lowest))
Within the same priority context, a deny rule will override an allow rule, and a force allow rule will
override a deny rule. By using the rule priorities system, a higher priority deny rule can be made to
override a lower priority force allow rule.
Consider the example of a DNS server policy that makes use of a force allow rule to allow all incoming
DNS queries over TCP/UDP port 53. Creating a deny rule with a higher priority than the force allow rule
lets you specify a particular range of IP addresses that must be prohibited from accessing the same public
server.
Priority-based rule sets allow you set the order in which the rules are applied. If a deny rule is set with
the highest priority, and there are no force allow rules with the same priority, then any packet matching
the deny rule is automatically dropped and the remaining rules are ignored. Conversely, if a force allow
rule with the highest priority flag set exists, any incoming packets matching the force allow rule will be
automatically allowed through without being checked against any other rules.
A Note on Logging
Bypass Rules will never generate a log entry. This is not configurable.
Log-only rules will only generate a log entry if the packet in question is not subsequently stopped by
either:
a deny rule, or
an allow rule that excludes it.
If the packet is stopped by one of those two rules, those rules will generate the log entry and not the logonly
rule. If no subsequent rules stop the packet, the log-only rule will generate an entry.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 145 -