Wanguard 6.2 User Guide
Configuration » Components » Filter Cluster
Configuration » Components » Filter Cluster
The functionality of Wanguard Filter is described in the “Choosing a Method of DDoS Mitigation” chapter on
page 10.
If you do not plan to use Filter Cluster(s) you can safely skip this chapter.
To add a Filter Cluster, click the <+> button found in the title bar of the Configuration » Components panel.
To configure an existing Filter Cluster, go to Configuration » Components and click its name.
The
Filter Cluster Configuration
window contains the following fields:
●
Filter Name
– A short name that helps you identify the Filter Cluster.
●
Graph Color
– The color used in graphs for the Filter Cluster. The default color is a random one, which
can be changed by entering a different HTML color code or by clicking the drop-down menu.
●
Device Group
– Optional description used within Console to group up components (e.g. by location or
role). It can be used to restrict the access of Guest accounts.
●
Reports Visibility
– Enable if the Filter Cluster should be listed inside Reports » Components.
●
Server Topology
– Select the network topology of the server running the Packet Filter:
○
Layer 2/3 - Inline filtering
– Filter Cluster runs on a server that resides in the main data path,
configured as a network bridge or as an OSI Layer 3 router.
To enable routing on the filtering server follow the steps required by your Linux distribution. At least
the following command needs to be executed:
sysctl -w net.ipv4.ip_forward=1;
sysctl -w net.ipv4.conf.all.forwarding=1;
sysctl -w net.ipv4.conf.default.rp_filter=0;
sysctl -w net.ipv4.conf.all.rp_filter=0
To run Filter Cluster in this mode, set the interface connected to the peering/border router as
Inbound Interface. To inject the packets back into the network, set a core router as the default
gateway, reachable through the Outbound Interface, either directly (recommended) or through a
GRE/IP in IP tunnel.
To configure the filtering server as a network bridge, follow the steps required by your Linux
distribution. To run Filter Cluster in this mode, set the Inbound Interface to the bridged interface,
usually br0.
○
Inline monitoring
– Filter Cluster runs on a server that resides in the main data path, configured as
an OSI Layer 3 router or as a network bridge. Direct filtering is disabled, but Filter Cluster can still
generate filtering rules that improve the visibility of attacks, which can be applied to other in-line
appliances or firewalls. To run Filter Cluster in this mode, set the parameters like in the Inline
filtering mode.
○
Layer 2/3 - Out-of-line filtering
– To run Filter Cluster in this mode, set the Traffic Diversion
- 64 -
Summary of Contents for wanguard 6.2
Page 1: ......
