Wanguard 6.2 User Guide
Configuration » Components » Flow Filter
Configuration » Components » Flow Filter
The functionality of Wanguard Filter is described in the “Choosing a Method of DDoS Mitigation” chapter on
page 10.
If you do not plan to use Flow Filter(s) you can safely skip this chapter.
To add a Flow Filter, click the <+> button found in the title bar of the Configuration » Components panel. To
configure an existing Flow Filter, go to Configuration » Components and click its name.
The
Flow Filter Configuration
window contains the following fields:
●
Filter Name
– A short name that helps you identify the Flow Filter.
●
Graph Color
– The color used in graphs for the Flow Filter. The default color is a random one, which can
be changed by entering a different HTML color code or by clicking the drop-down menu.
●
Device Group
– Optional description used within Console to group up components (e.g. by location or
role). It can be used to restrict the access of Guest accounts.
●
Reports Visibility
– Enable if the Flow Filter should be listed inside Reports » Components.
●
Filter Server
– The server that runs the Flow Filter. The configuration of servers is described on page 37.
●
Server Topology
– Select the network topology of the server running the Flow Filter:
○
Layer 2/3 - Inline filtering
– Flow Filter runs on a server that resides in the main data path,
configured as a network bridge or as an OSI Layer 3 router.
To enable routing on the filtering server follow the steps required by your Linux distribution. At least
the following command needs to be executed:
sysctl -w net.ipv4.ip_forward=1;
sysctl -w net.ipv4.conf.all.forwarding=1;
sysctl -w net.ipv4.conf.default.rp_filter=0;
sysctl -w net.ipv4.conf.all.rp_filter=0
To run Flow Filter in this mode, set the interface connected to the peering/border router as Inbound
Interface. To inject the packets back into the network, set a core router as the default gateway,
reachable through the Outbound Interface, either directly (recommended) or through a GRE/IP in IP
tunnel.
To configure the filtering server as a network bridge, follow the steps required by your Linux
distribution. To run Flow Filter in this mode, set the Inbound Interface to the bridged interface,
usually br0.
○
Inline monitoring
– Flow Filter runs on a server that resides in the main data path, configured as an
OSI Layer 3 router or as a network bridge. Direct filtering is disabled, but Flow Filter can still
generate filtering rules that improve the visibility of attacks, which can be applied to other in-line
appliances or firewalls. To run Flow Filter in this mode, set the parameters like in the Inline filtering
mode.
- 60 -
Summary of Contents for wanguard 6.2
Page 1: ......
