Wanguard 6.2 User Guide
Configuration » Components » Filter Cluster
matched by it is blocked. The remaining traffic is passed.
○
Filtering rules drop matched traffic. Valid traffic is rate-limited –
Filter Cluster detects, reports and
applies filtering rules and rate-limits the remaining traffic. If the filtering rule is not whitelisted, the
traffic matched by it is blocked. The traffic that exceeds the packets/second threshold value is not
passed.
○
Filtering rules rate-limit matched traffic. Valid traffic is accepted –
Filter Cluster detects and reports
filtering rules and rate-limits matched traffic to the threshold value.
○
Apply the default Netfilter chain policy –
Filter Cluster detects and reports filtering rules, and applies
the default Netfilter chain policy. The Netfilter framework is still being used, but all rules have the
“RETURN” target. This option is usually used for testing purposes.
Click the options button on the right to be able to configure the following Software Firewall parameters:
○
Netfilter Chain
– set to
FORWARD
if the server forwards traffic or
INPUT
if it does not.
○
Netfilter Table
– the
ra w
option requires both Inbound and Outbound interfaces to be set. It
provides a better packet filtering performance compared to the
filter
option.
●
Hardware Firewall
– If you have a NIC that provides hardware filters, select the appropriate choice.
Since hardware filters do not consume CPU, use this option to complement the Software Firewall.
○
No hardware packet filtering
– Hardware filters are not applied.
○
Intel x520 or x540 10 Gigabit adapter (blocks IPv4 sources)
– Filter Cluster programs the Intel chipset
to drop IPv4 addresses from filtering rules that contain source IPs. Up to 4086 hardware filters
possible.
○
Intel x520 or x540 10 Gigabit adapter (blocks IPv4 destinations)
– Filter Cluster programs the Intel
chipset to drop IPv4 addresses from filtering rules that contain destination IPs. Up to 4086 hardware
filters possible.
○
Silicom Director 10 Gigabit adapter with PF_RING HW filters
– Filter Cluster uses the PF_RING
framework to apply the following hardware-based filtering rules on Silicom Director adapters:
source/destination IPv4, source/destination TCP/UDP port, IP protocol.
○
Chelsio T4 or T5 10/40 Gigabit adapter with LE-TCAM filters
– Filter Cluster uses the Chelsio API to
apply up to 487 filtering rules that contain any combination of source/destination IPv4/IPv6
addresses, source/destination UDP/TCP port, and IP protocol.
●
Sampling
(1/x)
– The default value is 1. Must be equal to the number of filtering servers activated for
the same anomaly when the Filter Cluster is used in a clustered architecture where each filtering server
receives traffic from a round-robin packet scheduler.
●
Rules Timeout
– When set to 0, filtering rules remain active for as long as the anomaly is active. Enter a
non-zero value for the filtering rules to expire only after the entered amount of seconds.
●
Whitelist
– A Filter Whitelist is a collection of user-created rules that prevent the filtering of critical
traffic. To add similar rules for multiple Filters, use Whitelist Templates (Configuration » Network &
Policy » <+> » Whitelist Template).
Filter Cluster might block attack patterns that you do not want to be blocked. Destination ports and
destination IP addresses are blocked only in worst-case scenarios when no other attack pattern is found.
In some cases, it is better to let potential malicious traffic enter the network than to filter critical traffic.
For example, if your DNS server is attacked by spoofed addresses on port 53 UDP, Filter Cluster might
- 66 -
Summary of Contents for wanguard 6.2
Page 1: ......
