Networks

Networks

This section provides information about the Networks in the NetworkShield Firewall 2006.

• Private networks
  
• Public networks

Private Networks

Private Networks define subnets that are protected. A Private Network is defined by the NIC the network is connected to and the IP addresses ranges. Private Networks can be used as sources and destinations in any rules. If no NIC is specified for a Private Network, the network is considered as non-existing and is not taken into account in rules. Private Network should be used to define your local subnets, Perimeter Networks (aka DMZ), connected via VPN or Dialup networks.

Public Networks

Public Networks define external untrusted networks. To define a Public Network in the system, you need to specify only NIC the Public Network is connected to.

The range of IP addresses for a Public Network includes all IP addresses without the IP addresses of Private Networks defined in the system.

Public Networks cannot act as a source for Network Rules (rules defining interaction between networks). Public Networks can be used in any other rules. You should use Public Networks to specify general untrusted networks, such as the Internet.

It is possible to specify several Public Networks in the system. For example, if you connect to several different ISPs.

Local Host

Local Host presents the server with installed NetworkShield Firewall. All traffic coming to and send from NetworkShield Firewall server is counted for the Local Host object.

There is no need to specify Network rules for the Local Host object.

The Local Host is a predefined one so it cannot be modified or deleted.

NetworkShield Firewall automatically creates a set of Predefined Firewall Policy rules necessary for the server and the local area network to work.

Users, Computers and IP Ranges

Users

User objects define network users. Users can be authenticated by their Windows Login or by their NetworkShield Firewall Login and Password. It is necessary to install NetworkShield Security Client on workstations for user authentication. Users can be used in Firewall rules and Traffic Usage rules.

Computers

Computer objects define network computers. A Computer can be identified by its IP address or IP and MAC address. NetworkShield Firewall automatically authenticates the computers you specify so there is no need to install NetworkShield Security Client. Computers can be used as sources and destinations in all rules.

IP ranges

IP range objects define ranges of IP addresses in networks. IP ranges can be used as sources and destinations in all rules.

Network Object Sets

Network sets

Network sets define network groups. Each network object can simultaneously belong to one Network set. Network sets can be used in any rules. If you use a Network set as a source in Network Rules, Public Networks belonging to it will not be used in the rule.

Groups

Groups define user groups. Each user can belong to only one group at a time. Group can be used in any rules except Network Rules.

Computer sets

Computer sets define computer groups. Each computer can belong to only one Computer sets at a time. Computer sets can be used in any rules.

Predefined Objects and sets

NetworkShield Firewall automatically creates a set of predefined objects. Predefined objects are necessary to create the main network security policies.

Predefined objects cannot be deleted.

First Private Network
First Private Network defines one of protected networks. Predefined access rules created for the local area network to work are based on First Private Network. During its installation, NetworkShield Firewall automatically creates network parameters based on private IP address ranges, as defined in RFC 1918. You can change the First Private Network parameters the way you need.

First Public Network
First Public Network defines one of external untrusted networks. First Public Network automatically includes all ranges of IP addresses without those addresses that are specified in all specified Private Networks.

Anywhere
The Anywhere object represents the entire range of IP addresses (0.0.0.0 - 255.255.255.255). Rules with the Anywhere object are created for all interfaces existing in the system.

All Networks
The All Networks group includes all networks defined in the system no matter if they belong to other groups. You cannot delete or modify this group.

All Private Networks
The All Private Networks group includes all Private networks defined in the system no matter if they belong to other groups. You cannot delete or modify this group.

All Public Networks
The All Public Networks group includes all Public networks defined in the system no matter if they belong to other groups. You cannot delete or modify this group.

All Users
The All Users group includes all Users defined in the system no matter if they belong to other groups.

All Computers
The All Computers group includes all Computers defined in the system no matter if they belong to other groups. You cannot delete or modify this group.