You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description:
Following the modifications introduced in issue #929 to improve the configuration of netifyd, the DPI filter no longer works with VLANs. The following issues have been identified:
VLAN-based interfaces are missing from the list of filterable interfaces. This is likely because they are being read from the netifyd configuration instead of the network configuration.
Even when attempting to manually modify the DPI configuration file from the command line, specifiyng the device with itrs tag (e.g. eth0.20) rules are not applied correctly.
The issue arises because the generated netify-flow-actions.json file is not consistent with the new netifyd configuration.
Steps to Reproduce:
Attempt to filter VLAN-based interfaces using the DPI filter.
Check the available interfaces in the DPI configuration.
Modify the DPI configuration manually and observe that changes are not applied.
Expected Behavior:
VLAN-based interfaces should appear in the list of filterable interfaces.
DPI filtering should correctly apply rules to VLAN-based traffic.
Actual Behavior:
VLAN-based interfaces are not available for filtering.
Manually applied DPI rules are not effective due to inconsistencies in netify-flow-actions.json.
Example configuration before fix:
"actions": {
"rule0": {
"enabled": true,
"interface": "eth0.20",
"criteria": "(app == 'netify.youtube' or app == 'netify.facebook' or app == 'netify.amazon-prime' or app == 'netify.netflix' or proto == 'doh' or proto == 'dot') ;",
"targets": [
"block"
],
"exemptions": []
}
}
Example of proposed fix:
The actions in netify-flow-actions.json need to be modified as follows:
"actions": {
"rule0": {
"enabled": true,
"interface": "eth0",
"criteria": "vlan_id == 20 and (app == 'netify.youtube' or app == 'netify.facebook' or app == 'netify.amazon-prime' or app == 'netify.netflix' or proto == 'doh' or proto == 'dot') ;",
"targets": [
"block"
],
"exemptions": []
}
}
Diff:
- "interface": "eth0.20",- "criteria": "(app == 'netify.youtube' or app == 'netify.facebook' or app == 'netify.amazon-prime' or app == 'netify.netflix' or proto == 'doh' or proto == 'dot') ;"+ "interface": "eth0",+ "criteria": "vlan_id == 20 and (app == 'netify.youtube' or app == 'netify.facebook' or app == 'netify.amazon-prime' or app == 'netify.netflix' or proto == 'doh' or proto == 'dot') ;"
Components
NethSecurity 23.05.5
The text was updated successfully, but these errors were encountered:
Description:
Following the modifications introduced in issue #929 to improve the configuration of netifyd, the DPI filter no longer works with VLANs. The following issues have been identified:
The issue arises because the generated
netify-flow-actions.json
file is not consistent with the new netifyd configuration.Steps to Reproduce:
Expected Behavior:
Actual Behavior:
netify-flow-actions.json
.Example configuration before fix:
Example of proposed fix:
The actions in
netify-flow-actions.json
need to be modified as follows:Diff:
Components
NethSecurity 23.05.5
The text was updated successfully, but these errors were encountered: