LogLevel

{logging level}

Logging level of the component.

If the parameter value is not specified, the DefaultLogLevel parameter value from the [Root] section is used.

Default value: Notice

Log

{log type}

Logging method of the component.

Default value: Auto

ExePath

{path to file}

Executable path to the component.

Default value: <opt_dir>/bin/drweb-firewall.

•For GNU/Linux: /opt/drweb.com/bin/drweb-firewall.

•For FreeBSD: /usr/local/libexec/drweb.com/bin/drweb-firewall

XtablesLockPath

{path to file}

Path to the iptables (NetFilter) table blocking file. If the parameter value is not specified, the /run/xtables.lock and /var/run/xtables.lock paths are checked. If the file is not found in the specified path or default paths, when launching the component, an error occurs.

Default value: (not specified)

InspectFtp

{On | Off}

Scan the data transferred over the FTP protocol.

The data is scanned in accordance with the rules (see below).

Default value: On

InspectHttp

{On | Off}

Scan the data transferred over the HTTP protocol.

The data is scanned in accordance with the rules (see below).

Default value: On

InspectSmtp

{On | Off}

Scan data transferred over SMTP protocol (if installed, the Dr.Web MailD is used).

Real data scanning will be performed according to specified scan rules (see below).

Default value: On

InspectPop3

{On | Off}

Scan data transferred over POP3 protocol (if installed, the Dr.Web MailD is used).

Real data scanning will be performed according to specified scan rules (see below).

Default value: On

InspectImap

{On | Off}

Scan data transferred over IMAP protocol (if installed, the Dr.Web MailD is used).

Real data scanning will be performed according to specified scan rules (see below).

Default value: On

AutoconfigureIptables

{Yes | No}

Rules for configuring the NetFilter system component via the iptables interface.

Allowed values:

•Yes—configure rules for NetFilter when launching the component and remove them when finishing its operation automatically (recommended);

•No—do configure the rules automatically. The required rules must be added manually by the administrator before launching the component and removed after finishing its operation.

Default value: Yes

AutoconfigureRouting

{Yes | No}

The configuration mode for ip route and ip rule routing rules and policies.

Allowed values:

•Yes—configure routing rules and policies for ip route and ip rule when launching the component and remove them when finishing its operation automatically (recommended);

•No—do not perform configure rules automatically. Required rules are added manually by the administrator before launching the component and removed after finishing its operation.

Default value: Yes

LocalDeliveryMark

{integer | Auto}

The <LDM> mark for packets that are redirected to the Dr.Web Firewall for Linux network socket (specified in the TproxyListenAddress parameter, see below) to intercept the connection.

Allowed values:

•<integer>—<LDM> mark for packets. Equals 2N, where N is an LDM bit number in the packet, 0 ≤ N ≤ 31;

•Auto—allow Dr.Web Firewall for Linux to select the appropriate bit in the packet mark automatically (recommended).

Default value: Auto

ClientPacketsMark

{integer | Auto}

The <CPM> mark for packets transferred between the client that initiates the connection and Dr.Web Firewall for Linux.

Allowed values:

•<integer>—<СPM> mark for packets. Equals 2N, where N is a CPM bit number in the packet, 0 ≤ N ≤ 31;

•Auto—allow Dr.Web Firewall for Linux to select the appropriate bit in the packet mark automatically (recommended).

Default value: Auto

ServerPacketsMark

{integer | Auto}

<SPM> mark for packets transferred between Dr.Web Firewall for Linux and the server that receives the connection.

Allowed values:

•<integer>—<SPM> mark for packets. Equals 2N, where N is a SPM bit number in the packet, 0 ≤ N ≤ 31;

•Auto—allow Dr.Web Firewall for Linux to select the appropriate bit in the packet mark automatically (recommended).

Default value: Auto

TproxyListenAddress

{network socket}

Network socket (<IP address>:<port>) on which Dr.Web Firewall for Linux receives intercepted connections. If you specify port zero, it is selected automatically by the system.

Default value: 127.0.0.1:0

OutputDivertEnable

{Yes | No}

Enable/disable interception mode for incoming connections (i.e. connections initiated by applications on the remote with connections on the local host).

Allowed values:

•Yes—intercept and process outgoing connections;

•No—do not intercept and process outgoing connections.

Default value: No

OutputDivertNfqueueNumber

{integer | Auto}

Number of the queue NFQUEUE from which Dr.Web Firewall for Linux will retrieve SYN packages that initiate outgoing connections.

Allowed values:

•<integer>—queue number <ONum> to monitor the SYN packages of intercepted outgoing connections in NFQUEUE;

•Auto—allow Dr.Web Firewall for Linux to select an appropriate queue number automatically (recommended).

Default value: Auto

OutputDivertConnectTransparently

{Yes | No}

Enable/disable the emulation mode for connecting to the recipient (server) using the IP address of the sender of an intercepted package (client) for outgoing connections.

Allowed values:

•Yes—connect to the server using the address of the client that requested the connection instead of your own when intercepting the connection;

•No—connect to the server from the Dr.Web Firewall for Linux address.

As client and Dr.Web Firewall for Linux addresses are usually the same in the outgoing connections interception mode, the default value is No.

Default value: No

InputDivertEnable

{Yes | No}

Enable/disable interception of incoming connections (i.e. connections initiated by applications on the remote host with connections on the local host).

Allowed values:

•Yes— enable intercepting and processing incoming connections;

•No—disable intercepting and processing incoming connections.

Default value: No

InputDivertNfqueueNumber

{integer | Auto}

Number of the queue NFQUEUE from which Dr.Web Firewall for Linux will retrieve SYN packages that initiate incoming connections.

Allowed values:

•<integer>—queue number <INum> to monitor the SYN packages of intercepted outgoing connections in NFQUEUE;

•Auto—allow Dr.Web Firewall for Linux to select an appropriate queue number automatically (recommended).

Default value: Auto

InputDivertConnectTransparently

{Yes | No}

Enable/disable emulation mode for connecting to the recipient (server) using the IP address of the sender of an intercepted package (client) for incoming connections.

Allowed values:

•Yes—connect to the server using the address of the client that requested the connection instead of your own when intercepting the connection;

•No—connection to the server from the Dr.Web Firewall for Linux address.

In the incoming connections interception mode, all traffic goes through Dr.Web Firewall for Linux, and it is possibly to connect safely to the server using the fraudulent client’s addresses. This is why the default value is Yes.

Default value: Yes

ForwardDivertEnable

{Yes | No}

Enable/disable the interception of transit connections (i.e. connections initiated by applications on one remote host with connections on the other remote host).

Allowed values:

•Yes—enable intercepting and processing transit connections;

•No—disable intercepting and processing transit connections.

Default value: No

ForwardDivertNfqueueNumber

{integer | Auto}

The number of the queue NFQUEUE from which Dr.Web Firewall for Linux will retrieve SYN packages that initiate transit connections.

Allowed values:

•<integer>—queue number <FNum> to monitor the SYN packages of intercepted transit connections in NFQUEUE;

•Auto—allow Dr.Web Firewall for Linux to select an appropriate queue number automatically (recommended).

Default value: Auto

ForwardDivertConnectTransparently

{Yes | No}

Emulation mode for connecting to the recipient (server) using the IP address of the sender of an intercepted package (client) for transit connections.

Allowed values:

•Yes—connect to the server using the address of the client that requested the connection instead of your own when intercepting the connection;

•No—connect to the server from the Dr.Web Firewall for Linux address.

As there is no guarantee that in the transit connections interception mode all the traffic goes through the same host (router) on which have Dr.Web Firewall for Linux is installed, the default value is No for the correct operation. If the network configuration guarantees that protected applications are use same router, the parameter can be set to Yes, and in this case, Dr.Web Firewall for Linux will always evaluate connection to client’s addresses when connecting to servers.

Default value: No

ExcludedProc

{path to file}

White list of processes (process for which the network activity is not monitored).

You can specify a list as the parameter value. The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list of processes wget and curl.

1.Adding values to the configuration file.

•Two values in a line:

•Two lines (a value per line):

2.Adding values via the drweb-ctl cfset command:

Default value: (not set)

UnwrapSsl

{Boolean}

Scan encrypted traffic transferred via the SSL/TLS connections.

Default value: No

BlockInfectionSource

{Boolean}

Block connection attempts to websites containing malicious software (included into the InfectionSource category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: Yes

BlockNotRecommended

{Boolean}

Block connection attempts to non-recommended websites (included into the NotRecommended category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: Yes

BlockAdultContent

{Boolean}

Block connection attempts to websites containing adult content (included into the AdultContent category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockViolence

{Boolean}

Block connection attempts to websites containing graphic violence (included into the Violence category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockWeapons

{Boolean}

Block connection attempts to websites dedicated to weapons (included into the Weapons category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockGambling

{Boolean}

Block connection attempts to gambling websites (included into the Gambling category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockDrugs

{Boolean}

Block connection attempts to websites dedicated to drugs (included into the Drugs category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockObsceneLanguage

{Boolean}

Block connection attempts to websites containing obscene language (included into the ObsceneLanguage category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockChats

{Boolean}

Block connection attempts to chat websites (included into the Chats category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockTerrorism

{Boolean}

Block connection attempts to websites dedicated to terrorism (included into the Terrorism category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockFreeEmail

{Boolean}

Block connection attempts to websites of free email services (included into the FreeEmail category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockSocialNetworks

{Boolean}

Block connection attempts to social networking websites (included into the SocialNetworks category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockDueToCopyrightNotice

{Boolean}

Block connection attempts to websites that were added according to copyright holder requests (included into the DueToCopyrightNotice category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockOnlineGames

{Boolean}

Block connection attempts to Online games websites (included into OnlineGames category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockAnonymizers

{Boolean}

Block connection attempts to anonymizers websites (included into Anonymizers category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockCryptocurrencyMiningPools

{Boolean}

Block connection attempts to websites provide an access to common services for cryptocurrencies mining (included into CryptocurrencyMiningPool category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockJobs

{Boolean}

Block connection attempts to job search websites (included into Jobs category).

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

Whitelist

{domain list}

White list of domains (domains allowed for connection for users, even if these domains are included into blocked categories. In addition, user access will be allowed to all sub-domains of domains indicated in this list).

The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list of domains example.com and example.net.

1.Adding of values to the configuration file.

•Two values in one string:

•Two strings (one value per a string):

2.Adding values via the drweb-ctl cfset command:

Default value: (not set)

Blacklist

{domain list}

List of domains that can be used as the black list (i.e. list of domains forbidden for connection for users, even if these domains are not included into blocked categories. In addition, user access will be forbidden to all sub-domains of domains indicated in this list).

The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list of domains example.com and example.net.

1.Adding of values to the configuration file.

•Two values in one string:

•Two strings (one value per a string):

2.Adding values via the drweb-ctl cfset command:

Default value: (not set)

ScanTimeout

{time interval}

Time-out for scanning one file initiated by SpIDer Gate.

Acceptable values: from 1 second (1s) to 1 hour (1h).

Default value: 30s

HeuristicAnalysis

{On | Off}

Enable/disable heuristic analysis for detection of known threats. Heuristic analysis provides higher detection reliability but, at the same time, it increases time of virus scanning.

Action applied to threats detected by the heuristic analyzer is specified as the BlockSuspicious parameter value.

Allowed values:

•On—enable heuristic analysis when scanning;

•Off—disable heuristic analysis.

Default value: On

PackerMaxLevel

{integer}

Maximum nesting level for packed objects. A packed object is executable code compressed with special software (UPX, PELock, PECompact, Petite, ASPack, Morphine and so on). Such objects may include other packed objects which may also include packed objects. etc. he value of this parameter specifies the nesting limit beyond which packed objects inside other packed objects will not be scanned.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 8

ArchiveMaxLevel

{integer}

Maximum nesting level for archives (zip, rar, and so on) in which other archives may be enclosed (and these archives may also include other archives, and so on). The value of this parameter specifies the nesting limit beyond which archives enclosed in other archives will not be scanned.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 8

MailMaxLevel

{integer}

Maximum nesting level for files of mailers (pst, tbb and so on) in which other files may be enclosed (and these files may also include other files and so on). The value of this parameter specifies the nesting limit beyond which objects inside other objects will not be scanned.

The nesting level is not limited. If the value is set to 0, nested objects are not scanned.

Default value: 8

ContainerMaxLevel

{integer}

Maximum nesting for other types objects inside which other objects are enclosed (HTML pages, jar-files, etc.). The value of this parameter specifies the nesting limit beyond which objects inside other objects will not be scanned.

The nesting level is not limited.If the value is set to 0, nested objects are not scanned.

Default value: 8

MaxCompressionRatio

{integer}

Maximum compression ratio of compressed/packed objects (ratio between the uncompressed size and the compressed size). If the ratio of an object exceeds the limit, this object will be skipped during file scanning procedures initiated by SpIDer Gate.

The compression ratio must not be smaller than 2.

Default value: 500

BlockKnownVirus

{Boolean}

Block either incoming or outgoing data containing known threats.

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: Yes

BlockSuspicious

{Boolean}

Block either incoming or outgoing data containing unknown threats detected by the heuristic analyzer.

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: Yes

BlockAdware

{Boolean}

Block either incoming or outgoing data containing adware.

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: Yes

BlockDialers

{Boolean}

Block either incoming or outgoing data containing dialer programs.

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: Yes

BlockJokes

{Boolean}

Block either incoming or outgoing data containing joke programs.

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockRiskware

{Boolean}

Block either incoming or outgoing data containing riskware.

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockHacktools

{Boolean}

Block either incoming or outgoing data containing hacktools.

To activate blocking, the following rule should be added to the settings (see the details below):

Default value: No

BlockUnchecked

{Boolean}

Block the traffic that cannot be scanned.

Default value: No

InterceptHook

{path to file | Lua function}

Script for processing connections in Lua or path to the file containing the script (see the Processing connections in Lua section).

If unavailable file is specified, an error appears when loading the component.

Default value:

local dwl = require 'drweb.lookup'

function intercept_hook(ctx)

 -- do not check if group == Root.TrustedGroup
 if ctx.divert == "output" and ctx.group == "drweb"
 then
     return "pass"
 end

 -- do not check connections from privileged ports
 -- except FTP active mode
 if ctx.src.port >= 0 and ctx.src.port <= 1024
     and ctx.src.port ~= 20
 then
     return "pass"
 end

 return "check"
end