Wanguard 6.2 User Guide
Configuration » Components » Filter Cluster
block port 53 UDP traffic towards your DNS server, making it partially unreachable from the Internet. In
this case, configure a proper whitelist rule (Rule Type:
Dst Port UDP
, Operator:
equal
, Rule Value:
53
)
and review Configuration » General Settings » Mitigation Options.
To add a new rule to the whitelist, enter the following information:
○
Description
– Add a description for the whitelist rule.
○
Prefix
– Enter a subnet that must include the anomaly IP address, for the whitelist rule to be valid.
Enter 0.0.0.0/0 for a generic whitelist rule.
○
Decoder
– Select the decoder of the anomaly, or select
All
for a generic whitelist rule.
○
Rule Type
– Possible values:
Source IP, Src Port TCP, Dst Port TCP, Src Port UDP, Dst Port UDP, Packet
Length, IP TimeToLive, IP Protocol
.
○
Operator
– Operators for strings and numbers:
equal, non-equal.
Operators for numbers:
less than,
greater than
.
○
Rule Value
– A user-defined value that should match.
○
FW Policy
– When
FW Policy
is
Permit
and
Operator
is
equal,
the Flow Filter explicitly allows the
matched traffic to pass through the Software Firewall. Otherwise, a more generic filtering rule might
match the white-listed filtering rule.
When a filtering rule cannot be applied because it conflicts with a whitelist rule, a small white flag icon
appears next to it in Console reports.
●
Comments
– Comments about the Filter Cluster can be saved here. These observations are not visible
elsewhere.
Enable the Filter Cluster from Configuration » Components by clicking the gray square button next to its
name.
An instance of the Filter Cluster is launched when a traffic anomaly triggers the Response action “Detect
filtering rules and mitigate the attack with Wanguard Filter”. The Filter Cluster instance automatically launches the
associated Filters, so there is no need to add them to Response.
- 67 -
Summary of Contents for wanguard 6.2
Page 1: ......
