Wanguard 6.2 User Guide
Configuration » Components » Packet Filter
filtering rule. Packet Filter can do software-based packet filtering and packet rate limiting using the
Netfilter framework provided by the Linux kernel. The software-based packet filter is very flexible, and
since Packet Filter does not use the connection tracking mechanism specific to stateful firewalls, it is
very fast as well.
○
No software packet filtering –
Packet Filter detects and reports filtering rules. The Linux firewall API
is not used. You can implement other filtering commands using custom scripts executed by
Responses.
○
Filtering rules drop matched traffic. Valid traffic is accepted –
Packet Filter detects, reports and
applies filtering rules using the software firewall. If the filtering rule is not whitelisted, the traffic
matched by it is blocked. The remaining traffic is passed.
○
Filtering rules drop matched traffic. Valid traffic is rate-limited –
Packet Filter detects, reports and
applies filtering rules and rate-limits the remaining traffic. If the filtering rule is not whitelisted, the
traffic matched by it is blocked. The traffic that exceeds the packets/second threshold value is not
passed.
○
Filtering rules rate-limit matched traffic. Valid traffic is accepted –
Packet Filter detects and reports
filtering rules and rate-limits matched traffic to the threshold value.
○
Apply the default Netfilter chain policy –
Packet Filter detects and reports filtering rules, and applies
the default Netfilter chain policy. The Netfilter framework is still being used, but all rules have the
“RETURN” target. This option is usually used for testing purposes.
Click the options button on the right to be able to configure the following Software Firewall parameters:
○
Netfilter Chain
– set to
FORWARD
if the server forwards traffic or
INPUT
if it does not.
○
Netfilter Table
– the
ra w
option requires both Inbound and Outbound interfaces to be set. It
provides a better packet filtering performance compared to the
filter
option.
●
Hardware Firewall
– If you have a NIC that provides hardware filters, select the appropriate option.
Since hardware filters do not consume CPU, use this option to complement the Software Firewall.
○
No hardware packet filtering
– Hardware filters are not applied.
○
Intel x520 or x540 10 Gigabit adapter (blocks IPv4 sources)
– Packet Filter programs the Intel chipset
to drop IPv4 addresses from filtering rules that contain source IPs. Up to 4086 hardware filters
possible.
○
Intel x520 or x540 10 Gigabit adapter (blocks IPv4 destinations)
– Packet Filter programs the Intel
chipset to drop IPv4 addresses from filtering rules that contain destination IPs. Up to 4086 hardware
filters possible.
○
Silicom Director 10 Gigabit adapter with PF_RING HW filters
– Packet Filter uses the PF_RING
framework to apply the following hardware-based filtering rules on Silicom Director adapters:
source/destination IPv4, source/destination TCP/UDP port, IP protocol.
○
Chelsio T4 or T5 10/40 Gigabit adapter with LE-TCAM filters
– Packet Filter uses the Chelsio API to
apply up to 487 filtering rules that contain any combination of source/destination IPv4/IPv6
addresses, source/destination UDP/TCP port, and IP protocol.
●
Sampling
(1/x)
– The default value is 1. Must be equal to the number of filtering servers activated for
the same anomaly when the Packet Filter is used in a clustered architecture where each filtering server
receives traffic from a round-robin packet scheduler.
- 57 -
Summary of Contents for wanguard 6.2
Page 1: ......
