Wanguard 6.2 User Guide
Reports » Tools
Reports » Tools » Firewall Rules
Reports » Tools
displays the number of firewall rules with the match count increased in the last 5 seconds.
The Firewall Rules tab lists all firewall rules managed by Wanguard and provides a quick and easy way for
Console users to define their own rules. The tab contains 2 sub-tabs, located at the lower left side of the window:
Active Firewall Rules
It displays all firewall rules generated automatically by Filters or manually by Console users.
Administrators and operators can add or delete firewall rules manually. To add a new Firewall Rule click the
<
Create Firewall Rule
> button
. You will have to choose whether to apply the firewall rule using a software firewall (1
st
option) or using a hardware firewall specific to Chelsio NICs (2
nd
option).
The <
Remove All
> button deletes all firewall rules from the UI without updating the actual firewall.
The
Create Software Firewall Rule
window provides the following options:
●
Rule Description
– A short name that helps you identify the firewall rule. This is the only mandatory
field.
●
Direction
– Select
Inbound
to match packets entering your network (through interfaces defined as
Inbound in the Filter Configuration window). Otherwise, select
Outbound
.
●
Filter(s)
– Select the Filters that must apply the firewall rule, according to their configuration (Interfaces,
Netfilter Chain, Netfilter Table).
●
IP Protocol(s)
– Select one or more IP protocols, or
Any
to match all packets.
●
Src/Dst IP/mask
– Enter to match packets by their source or destination IP blocks. The mask is optional
(defaults to /32 for IPv4 and /128 for IPv6).
●
Src/Dst Port(s)
– This field is available only for the following IP protocols: TCP, UDP, UDPLITE, DCCP, and
SCTP. It matches a set of source or destination ports. Up to 15 ports can be specified (e.g. 53,
1024:65535 would match ports 53 and all from 1024 through 65535).
●
IP Packet Length
– It is used to match the length of the layer-3 payload (e.g. layer-4 packet) of packets
against a specific value or range of values separated by “:”.
●
IP TimeToLive
– It is used to match the time to live (TTL) field in the IP header. If the value is preceded
by “>”, then the traffic is matched if TTL is greater than the given TTL value. If the value is preceded by
“<”, then the traffic is matched if TTL is less than the given TTL value.
●
TCP Flags Set/Unset
– Select the TCP flags that must be explicitly set and/or unset. TCP flags not
enabled in either fields are ignored by the packet matching mechanism.
●
Payload Content
– Enter to match a string anywhere in the packet. Use this match with caution as it
consumes a lot of CPU resources.
●
Country(ies)
– Select to match packets by their country. This option can be used if the
xp_geoip
Netfilter
module is installed.
- 80 -
Summary of Contents for wanguard 6.2
Page 1: ......
