D3-DNL Directional Network Link: Enforcing One-Way Flows and Proving They Hold

A firewall rule can be changed, exploited or misconfigured, but a link with no physical return path cannot carry an inbound attack however it is configured. MITRE D3FEND names this countermeasure Directional Network Link (D3-DNL) and defines it as "Enforce one-way network communication by preventing two-way communication." It sits under the Isolate tactic as a child of Network Isolation (D3-NI), and D3FEND models it with two artefacts: it restricts a Physical Link and uses a Physical Data Diode. This card covers what D3FEND says about the technique, why it has no ATT&CK mapping, how it is implemented, how to prove the one-way property holds in operation and where it stops. It is for OT architects and security engineers who already know the design choices in the Data Diodes and Unidirectional Gateways Guide and want the D3FEND view and a verification plan.

Key takeaways

• The guarantee is physical. D3FEND describes using a data diode, or otherwise enforcing unidirectional transfer, "to physically prevent signals from traveling in the reverse direction."
• D3FEND frames it as an OT safety control. Its description says one-way links separate control and safety systems so safety information can be viewed without permitting modification or interference.
• There is no ATT&CK mapping. The D3FEND page states "No related offensive techniques in this release" for every matrix; the technique's value has to be argued from its artefacts and the attack paths it removes.
• Verification is about the whole path. The diode cannot fail open, but parallel connections, maintenance links, reversible devices and removable media can bypass it; testing must look for those.
• It is one component of an architecture. NIST SP 800-82 Rev. 3 lists unidirectional gateways among network segmentation and isolation options, and the NCSC import pattern pairs one-way flow control with protocol break, transformation and verification.

D3-DNL at a glance

D3FEND version 1.6.0, checked November 2026. Parent, siblings and artefacts are taken from the D3FEND ontology.

How it works

The patent D3FEND cites describes the core mechanism. A send node uses send-only network interface circuitry that transmits onto the data link and is "configured not to receive any data", and a receive node uses receive-only circuitry that is configured not to send any data back. The link can be optical fibre or shielded copper, and the interface circuitry can attach to each host by PCI, USB, FireWire or serial connection. Because one side has no transmitter and the other no receiver for the reverse direction, the property does not depend on software configuration.

NIST SP 800-82 Rev. 3, Appendix E.1.2, describes unidirectional gateways (also called data diodes) as devices "designed to only allow data transmission in a single direction", notes that unlike a firewall they cannot be reconfigured for two-way flow because "the hardware is incapable", and gives the typical placement: at the boundary between the operational and enterprise networks, so traffic can leave the OT network but not enter it.

In practice a bare diode is paired with software on each side. A sending proxy reads data on the protected side (historian records, alarms, logs, files) and a receiving proxy recreates it on the other side as a replica, because protocols that need acknowledgements cannot complete across a one-way link. The Data Diodes and Unidirectional Gateways Guide covers gateway design, protocol support and the regulatory picture in depth, so this card does not repeat it.

Direction is a design choice

• Outbound (export) diode: data leaves the protected network, nothing returns. This is the OT monitoring case D3FEND describes.
• Inbound (import) diode: data enters a protected network and nothing can leave, used where confidentiality of the protected side matters most. The NCSC safe import pattern uses one-way flow control in this direction, after a protocol break.
• Separate import and export paths: the NCSC network protocol attack protection principle calls for one-way flows enforced in hardware and for import and export flows to be kept separate, so an exposed component cannot be used for onward compromise.

ATT&CK techniques and D3-DNL

Relationship type: none in D3FEND. The D3FEND page for D3-DNL states "No related offensive techniques in this release" across the Enterprise, ICS, Mobile, SPARTA and ATLAS matrices (D3FEND 1.6.0, checked November 2026). D3FEND's inferred mappings come from shared digital artefacts, and no ATT&CK technique is modelled as acting on a Physical Link or a Physical Data Diode.

The table below is therefore NHI Mgmt Group's own view, not a D3FEND mapping: techniques whose network path across a correctly placed outbound diode is physically removed. Each ID was checked against ATT&CK v20.

The last two rows matter as much as the first four. A diode removes network paths across one link; it does nothing for paths that never use that link.

Where it is implemented

The wider segmentation design, including where a one-way conduit fits among zones, is in the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.

Deployment steps

1. Define the flows that must cross. List every data flow between the protected network and the outside, its direction and its consumer. Flows that genuinely need two-way traffic (remote engineering, recipe downloads) cannot use the diode and need a separate, tightly controlled path.
2. Pick the direction and placement. Place the diode at the conduit between zones, typically between the OT network and a DMZ or enterprise network for export, and document it in the zone and conduit model.
3. Plan the inward path first. Patches, antivirus signatures, configuration changes and time synchronisation still need to reach the protected side. Decide how, before cutting over, so that nobody adds an undocumented bypass later.
4. Build replicas and test protocols. Configure the sending and receiving proxies for each flow and confirm the receiving side gets complete, timely data, including after link interruption.
5. Run in parallel, then cut over. Run the diode path alongside the existing connection, compare data completeness, then remove the old two-way connection and record its removal.
6. Keep a rollback that is not a permanent bypass. If the gateway fails, the safe fallback is loss of visibility on the enterprise side, not re-enabling the old firewall path. Any emergency two-way path needs an owner, a time limit and a change record.

How to verify it works

The diode hardware itself cannot be reconfigured to pass traffic backwards, so verification focuses on whether the architecture around it still depends on the diode alone.

• Reverse-direction test: during a maintenance window and with operator approval, attempt a connection from the low side to a listener on the high side across the link and confirm nothing arrives. Record the result as evidence.
• Bypass discovery: use passive network monitoring on the protected side to look for any traffic to or from the less trusted network that does not pass through the diode, such as a forgotten firewall rule, a cellular modem, a vendor remote access box or a dual-homed engineering workstation. The OT Network Security Monitoring Guide covers the sensors.
• Physical inspection: check cabling and configuration of reversible or bidirectional variants. A device that can be switched to two-way operation is no longer a one-way control while it is switched.
• Data completeness: compare record counts and timestamps between source and replica, since silent data loss leads operators to request a two-way path "just for now".
• Removable media and maintenance paths: confirm these have their own controls, because the diode does not cover them.

Limits, bypasses and failure patterns

• Parallel paths: a diode on the main conduit with a vendor VPN or cellular router beside it gives a false sense of isolation. Remote access needs its own design; see the OT Remote Access Guide.
• Reversible devices: products that can switch direction or that add a return channel are two-way connections in the switched state and must be assessed that way.
• Proxy compromise on the high side: the sending proxy sits inside the protected network and processes data there; harden and patch it like any other OT host.
• Integrity of exported data: the diode protects the source from the destination, not the destination from false data; an attacker inside the protected network can still send misleading data out.
• Inward updates by improvised means: if no inward path was designed, staff carry patches and files on removable media with little control. Design that path and its scanning, for example with D3-CNR Content Rebuild at an import point.
• Credentials still matter. Service accounts and shared credentials used by the proxies and by any remaining two-way path are identities to manage; see the Identity for OT Environments Guide.

Framework mapping

Sector rules on one-way flows, such as nuclear and electricity requirements, are summarised in the Data Diodes and Unidirectional Gateways Guide and the NERC CIP Guide.

Related countermeasures

• Network Traffic Filtering (D3-NTF): the software-enforced sibling for flows that must be two-way; see D3-NTF Network Traffic Filtering.
• Broadcast Domain Isolation (D3-BDI): separation inside a network rather than at its boundary; see D3-BDI Broadcast Domain Isolation.
• IO Port Restriction (D3-IOPR): controls the removable media path a diode does not cover; see D3-IOPR IO Port Restriction.
• Overview: the MITRE D3FEND Guide.

Practitioner checklist

• List every flow across the boundary with direction and consumer before choosing a diode.
• Document the diode as a conduit in the zone and conduit model.
• Design the inward path for patches, signatures and files before cut-over.
• Remove the old two-way connection after parallel running and record its removal.
• Run passive monitoring on the protected side to find bypass paths.
• Record a reverse-direction test per link at least yearly.
• Treat reversible or switchable devices as two-way connections when switched.
• Harden and patch the high-side sending proxy and manage its service credentials.
• Give every emergency two-way path an owner, an expiry and a change record.

Standards and references

• MITRE D3FEND: Directional Network Link (D3-DNL)
• OWL Computing Technologies: Secure one-way data transfer using communication interface circuitry (US8068415B2)
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls (AC-4(7))
• NCSC: Cross domain solutions, network protocol attack protection
• NCSC: Pattern for safely importing data

Related NHI Mgmt Group resources: Data Diodes and Unidirectional Gateways Guide · OT Security Guide · OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide · IEC 62443 Guide · MITRE D3FEND Guide