Wanguard 6.2 User Guide
Configuration » Components » Packet Filter
Packet Filter Troubleshooting
✔
To view the counters for each Netfilter or Chelsio filtering rule go to Reports » Tools » Firewall Rules.
✔
To see the filtering rules applied by the Netfilter framework (the Software Firewall option) from the CLI:
iptables -L -n -v && iptables -L -n -v -t raw
To delete all chains:
for chain in `iptables -L -t raw | grep wanguard | awk '{ print $2 }'`; do
iptables -X $chain; done
✔
To view the filtering rules applied by the Intel 80599 chipset:
ethtool --show-ntuple <filtering_interface>
or, for kernels >3.1:
ethtool --show-nfc <filtering_interface>
✔
To ensure that filtering rules can be applied on the Intel 80599 chipset, load the ixgbe driver with the
parameter
FdirPballoc=3
. To prevent getting “
Location out of range
” errors from the ixgbe driver, load
it with the right parameters in order to activate all 8k filtering rules.
✔
To view filtering rules applied by the Chelsio T4/T5 chipset:
cxgbtool <filtering_interface> filter show
✔
If the CPU usage of the Packet Filter instance is too high, install PF_RING (no ZC/DNA/LibZero needed),
or use a network adapter that allows distributing Packet Filters over multiple CPU cores.
✔
For PF_RING installation issues, contact ntop.org. To increase the maximum number of PF_RING
programs from 64 to 256, increase the MAX_NUM_RING_SOCKETS defined in kernel/linux/pf_ring.h and
recompile the pf_ring kernel module.
✔
The event log error “
License key not compatible with the existing server”
can be fixed by sending the
string from Configuration » Servers » [Packet Filter server] » Hardware Key to sales@andrisoft.com.
✔
Make sure you are running the latest version of the software.
- 59 -
Summary of Contents for wanguard 6.2
Page 1: ......
