Wanguard 6.2 User Guide
Configuration » Components » Flow Filter
Click the options button on the right to be able to configure the following Software Firewall parameters:
○
Netfilter Chain
– set to
FORWARD
if the server forwards traffic or
INPUT
if it does not.
○
Netfilter Table
– the
ra w
option requires both Inbound and Outbound interfaces to be set. It
provides a better packet filtering performance compared to the
filter
option.
●
Hardware Firewall
– If you have a NIC that provides hardware filters, select the appropriate choice.
Since hardware filters do not consume CPU, use this option to complement the Software Firewall.
○
No hardware packet filtering
– Hardware filters are not applied.
○
Intel x520 or x540 10 Gigabit adapter (blocks IPv4 sources)
– Flow Filter programs the Intel chipset
to drop IPv4 addresses from filtering rules that contain source IPs. Up to 4086 hardware filters
possible.
○
Intel x520 or x540 10 Gigabit adapter (blocks IPv4 destinations)
– Flow Filter programs the Intel
chipset to drop IPv4 addresses from filtering rules that contain destination IPs. Up to 4086 hardware
filters possible.
○
Silicom Director 10 Gigabit adapter with PF_RING HW filters
– Flow Filter uses the PF_RING
framework to apply the following hardware-based filtering rules on Silicom Director adapters:
source/destination IPv4, source/destination TCP/UDP port, IP protocol.
○
Chelsio T4 or T5 10/40 Gigabit adapter with LE-TCAM filters
– Flow Filter uses the Chelsio API to
apply up to 487 filtering rules that contain any combination of source/destination IPv4/IPv6
addresses, source/destination UDP/TCP port, and IP protocol.
●
Sampling
(1/x)
– The default value is 1. Must be equal to the number of filtering servers activated for
the same anomaly when the Flow Filter is used in a clustered architecture where each filtering server
receives traffic from a round-robin packet scheduler.
●
Rules Timeout
– When set to 0, filtering rules remain active for as long as the anomaly is active. Enter a
non-zero value for the filtering rules to expire only after the entered amount of seconds.
●
Whitelist
– A Filter Whitelist is a collection of user-created rules that prevent the filtering of critical
traffic. To add similar rules for multiple Filters, use Whitelist Templates (Configuration » Network &
Policy » <+> » Whitelist Template).
Flow Filter might block attack patterns that you do not want to be blocked. Destination ports and
destination IP addresses are blocked only in worst-case scenarios when no other attack pattern is found.
In some cases, it is better to let potential malicious traffic enter the network than to filter critical traffic.
For example, if your DNS server is attacked by spoofed addresses on port 53 UDP, Flow Filter might block
port 53 UDP traffic towards your DNS server, making it partially unreachable from the Internet. In this
case, configure a proper whitelist rule (Rule Type:
Dst Port UDP
, Operator:
equal
, Rule Value:
53
) and
review Configuration » General Settings » Mitigation Options.
To add a new rule to the whitelist, enter the following information:
○
Description
– Add a description for the whitelist rule.
○
Prefix
– Enter a subnet that must include the anomaly IP address, for the whitelist rule to be valid.
Enter 0.0.0.0/0 for a generic whitelist rule.
○
Decoder
– Select the decoder of the anomaly, or select
All
for a generic whitelist rule.
○
Rule Type
– Possible values:
Source IP, Src Port TCP, Dst Port TCP, Src Port UDP, Dst Port UDP, Packet
Length, IP TimeToLive, IP Protocol
.
- 62 -
Summary of Contents for wanguard 6.2
Page 1: ......
