Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| en:dpi:dpi_components:dpiui:ulr_ui:start [2021/07/23 10:37] – created arusnak | en:dpi:dpi_components:dpiui:ulr_ui:start [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== 6 Filtering rules management interface ====== | ||
| - | {{indexmenu_n> | ||
| - | |||
| - | ====== Universal Locking Rules UI ====== | ||
| - | |||
| - | ===== Introduction ===== | ||
| - | Universal locking rules (ULR) UI is designed to manage filtering rules on multiple DPIs simultaneously using a graphical interface. | ||
| - | |||
| - | ===== Installation ===== | ||
| - | Equipment or virtual machines with the following characteristics are suitable for the subsystem: | ||
| - | - CPU 2.5 GHz, 2-4 cores | ||
| - | - RAM from 8 GB (mainly for sphinx) | ||
| - | - Hard drive (HDD) 50 GB - 250 GB | ||
| - | - Cent OS 7+ operating system (we do not recommend to not install minimal, because most of the dependencies will have to be installed manually) | ||
| - | - Network Card (NIC) from 10 Mbps | ||
| - | |||
| - | < | ||
| - | </ | ||
| - | |||
| - | <note tip>The locking rules management interface is a special section of [[en: | ||
| - | |||
| - | ===== Configuration ===== | ||
| - | ==== .env Configuration ==== | ||
| - | The subnet configuration is handled with .env file. | ||
| - | < | ||
| - | |||
| - | The file contents: | ||
| - | < | ||
| - | #Redirect URL for "White list" service | ||
| - | ULR_WHITE_LIST_REDIRECT_URL=https:// | ||
| - | |||
| - | #The period after Ulr tasks data is deleted (days) | ||
| - | ULR_QUEUE_DELETE_TASKS_DAYS_INTERVAL=1 | ||
| - | |||
| - | #ASN for IP-exception rules | ||
| - | ULR_IP_EXCLUDE_ASN=64401 | ||
| - | |||
| - | #The host for blocked resources list deployment. To connect the blocked resources server. | ||
| - | ULR_BLACK_LIST_DEPLOY_HOST=< | ||
| - | |||
| - | #The port for blocked resources list deployment. To connect the blocked resources server. | ||
| - | ULR_BLACK_LIST_DEPLOY_PORT=22 | ||
| - | |||
| - | #Username for blocked resources list deployment. To connect the blocked resources server. | ||
| - | ULR_BLACK_LIST_DEPLOY_USER=default | ||
| - | |||
| - | #Password for blocked resources list deployment. To connect the blocked resources server. | ||
| - | ULR_BLACK_LIST_DEPLOY_PASS= | ||
| - | |||
| - | #To use sudo for blocked resources list deployment. (0 - do not use, 1 - use) | ||
| - | ULR_BLACK_LIST_DEPLOY_SUDO=1 | ||
| - | |||
| - | #Black lists saving path. | ||
| - | ULR_BLACK_LIST_DEPLOY_PATH=/ | ||
| - | |||
| - | #Log Detail Level (0 - info, 1 - debug, 2 - tracing). | ||
| - | ULR_LOAD_LOG_LEVEL=0 | ||
| - | </ | ||
| - | |||
| - | <note important> | ||
| - | < | ||
| - | </ | ||
| - | |||
| - | <note tip> | ||
| - | |||
| - | ==== Key Installation ==== | ||
| - | |||
| - | To use the Universal Locking Rules UI, you need to activate the ULR-license in DPIUI2 with a command: | ||
| - | < | ||
| - | |||
| - | Next: | ||
| - | - Enter license level: standard | ||
| - | - Enter the license completion date in the Y-m-d format (e.g. 2099-12-31) | ||
| - | - Enter the license password. | ||
| - | |||
| - | If the data is correct, a success message will be displayed: | ||
| - | < | ||
| - | dpiui2 ulr_lic --make=1 | ||
| - | Enter level: | ||
| - | > standard | ||
| - | |||
| - | Enter expire date in Y-m-d format: | ||
| - | > 2099-12-31 | ||
| - | |||
| - | Enter password: | ||
| - | > | ||
| - | |||
| - | stdClass Object | ||
| - | ( | ||
| - | [success] => 1 | ||
| - | ) | ||
| - | </ | ||
| - | |||
| - | ==== Roles Management ==== | ||
| - | In the DPIUI2 interface visit the Administrator → Roles section. Create a new role and set read and write permissions in the ulr_admin section: | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | Next, go to the Administrator-> | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | After the user logs in, he is moved to the locking rules management section. | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ==== Dictionaries Configuration ==== | ||
| - | |||
| - | * Category Dictionary | ||
| - | * Regulators Dictionary | ||
| - | |||
| - | <note important> | ||
| - | |||
| - | === Category Dictionary === | ||
| - | In the Locking Rules management interface go to the Dictionaries → Categories section. | ||
| - | {{ : | ||
| - | |||
| - | == Creating == | ||
| - | Fill in the form with category name and description and click the " | ||
| - | {{ : | ||
| - | |||
| - | == Editing == | ||
| - | To edit: click on the category editing button in the categories table. In the form, change the name and/or description of the category, then click the " | ||
| - | {{ : | ||
| - | |||
| - | == Deleting == | ||
| - | Сlick on the delete category button in the categories table. In the pop-up window confirm or cancel the action. | ||
| - | {{ : | ||
| - | |||
| - | <note warning> | ||
| - | |||
| - | === Regulators Dictionary === | ||
| - | In the Locking Rules management interface go to the Dictionaries → Regulators section. | ||
| - | {{ : | ||
| - | |||
| - | == Creating == | ||
| - | Fill in the form with regulator name and description and click the " | ||
| - | {{ : | ||
| - | |||
| - | == Editing == | ||
| - | To edit: click on the regulator editing button in the regulators table. In the form, change the name and/or description of the regulator, then click the " | ||
| - | {{ : | ||
| - | |||
| - | == Deleting == | ||
| - | Сlick on the delete regulator button in the categories table. In the pop-up window confirm or cancel the action. | ||
| - | {{ : | ||
| - | |||
| - | <note warning> | ||
| - | |||
| - | ==== IGW Profiles Management ==== | ||
| - | Change to the section "ISPS & IGWS Profiles" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | === Creating === | ||
| - | |||
| - | To create new IGW profile change to the section "ISPS & IGWS Profiles" | ||
| - | |||
| - | In the form specify: | ||
| - | * Profile name; | ||
| - | * Operation mode (Standalone/ | ||
| - | * Nodes for the profile (Node name, DPI from the list of available equipment and number of bridges) | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | <note tip> | ||
| - | |||
| - | === Editing === | ||
| - | |||
| - | In the "ISPS & IGWS Profiles" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | |||
| - | The IGW profile creation/ | ||
| - | |||
| - | === Deleting === | ||
| - | |||
| - | In the "ISPS & IGWS Profiles" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | |||
| - | <note warning> | ||
| - | |||
| - | |||
| - | |||
| - | ===== Web Server for Global Lists Configuration ===== | ||
| - | ==== Web-server ==== | ||
| - | |||
| - | 1. Prepare a machine with CentOS7+ installed | ||
| - | |||
| - | 2. Create a sudo user without password as described in [[en: | ||
| - | |||
| - | 3. Run the script: | ||
| - | < | ||
| - | rpm --import http:// | ||
| - | rpm -Uvh http:// | ||
| - | yum install dpiutils -y | ||
| - | yum install httpd -y | ||
| - | yum install unzip -y | ||
| - | |||
| - | mkdir / | ||
| - | chmod -R 777 / | ||
| - | |||
| - | echo " | ||
| - | < | ||
| - | DocumentRoot \"/ | ||
| - | |||
| - | <proxy *> | ||
| - | Order deny,allow | ||
| - | Allow from all | ||
| - | </ | ||
| - | </ | ||
| - | " > / | ||
| - | |||
| - | firewall-cmd --permanent --add-port=80/ | ||
| - | firewall-cmd --reload | ||
| - | |||
| - | systemctl enable httpd.service | ||
| - | systemctl restart httpd.service | ||
| - | </ | ||
| - | |||
| - | 4. In dpiui2 configuration [[dpi: | ||
| - | |||
| - | 5. Specify the path to Custom lock list in the settings of all connected FastDPI servers: | ||
| - | < | ||
| - | # URL dictionary for blocking by HTTP (custom_url_black_list) | ||
| - | custom_url_black_list=http://< | ||
| - | |||
| - | # Names dictionary for blocking HTTPS protocol by certificate (custom_cname_black_list) | ||
| - | custom_cname_black_list=http://< | ||
| - | |||
| - | # IP addresses dictionary for blocking HTTPS by IP (custom_ip_black_list) | ||
| - | custom_ip_black_list=http://< | ||
| - | |||
| - | # Host names dictionary for blocking HTTPS by SNI (custom_sni_black_list) | ||
| - | custom_sni_black_list=http://< | ||
| - | </ | ||
| - | ===== DSCP Rules ===== | ||
| - | Change to " | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | === Creating === | ||
| - | |||
| - | In the form of rule creating: | ||
| - | * Enter the name of application protocol and choose one from the list; | ||
| - | * Choose the priority from the list. | ||
| - | |||
| - | Save the rule by clicking on "Set DSCP" button. | ||
| - | |||
| - | === Editing === | ||
| - | |||
| - | In the list of DSCP rules click on "Edit rule" button. In the popup editing form set the necessary priority and save changes by clicking on "Set DSCP" button. | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | |||
| - | === Deleting === | ||
| - | |||
| - | In the DSCP rules list click the button “Delete rule” and confirm/ | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ===== ASN Filter ===== | ||
| - | Change to the "ASN Filter" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | === Creating === | ||
| - | |||
| - | In the form of rule creating: | ||
| - | * Specify the number of AS; | ||
| - | * Choose the priority from the list; | ||
| - | * Enter the rule name; | ||
| - | * Enter the rule description. | ||
| - | |||
| - | Save the rule by clicking on "Set DSCP" button. | ||
| - | |||
| - | === Editing === | ||
| - | |||
| - | In the list of DSCP in ASN direction rules click on the "Edit rule" button. If necessary, in the popup editing form: | ||
| - | * choose the priority from the list; | ||
| - | * Enter the rule name; | ||
| - | * Enter the rule description. | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | Save the changes by clicking on "Set DSCP" button. | ||
| - | |||
| - | === Deleting === | ||
| - | In the list of DSCP in ASN direction rules click the button “Delete rule” and confirm/ | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ===== IP & ASN Excludes ===== | ||
| - | Change to the "IP & ASN Excludes" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ==== IP Excludes ==== | ||
| - | |||
| - | Change to the "IP & ASN Excludes" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | === Creating ==== | ||
| - | |||
| - | In the form of rule creating: | ||
| - | * Specify IP/CIDR; | ||
| - | * Enter the rule name; | ||
| - | * Enter the rule descriptuin; | ||
| - | |||
| - | Save the rule by clicking on "Set exclusion" | ||
| - | |||
| - | === Editing === | ||
| - | |||
| - | Click on the button "Edit exclusion" | ||
| - | In the form of rule editing you can change: | ||
| - | * name of the rule; | ||
| - | * its description. | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | Save the changes by clicking on "Set DSCP" button. | ||
| - | |||
| - | === Deleting === | ||
| - | |||
| - | In the list of exclusions click the button “Delete exclusion” and confirm/ | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ==== ASN Excludes ==== | ||
| - | |||
| - | Change to the "IP & ASN Excludes" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | == Creating === | ||
| - | |||
| - | In the form of rule creating: | ||
| - | * Specify AS number; | ||
| - | * Enter the rule name; | ||
| - | * Enter the rule descriptuin; | ||
| - | |||
| - | Save the changes by clicking on "Set Exclusion" | ||
| - | |||
| - | === Editing === | ||
| - | |||
| - | Click on the button "Edit exclusion" | ||
| - | In the form of rule editing you can change: | ||
| - | * name of the rule; | ||
| - | * its description. | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | Save the changes by clicking on "Set DSCP" button. | ||
| - | |||
| - | === Deleting === | ||
| - | |||
| - | In the list of exclusions click the button “Delete exclusion” and confirm/ | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ===== ISP Configuration ===== | ||
| - | Change to the "ISPS & IGWS Profiles" | ||
| - | |||
| - | {{ : | ||
| - | ==== Creating an ISP Profile ==== | ||
| - | To create new IGW profile go to the "ISPS & IGWS Profiles" | ||
| - | |||
| - | In the form specify: | ||
| - | * Name of ISP profile; | ||
| - | * Choose the border from the list; | ||
| - | * Login to be used on the DPI node; | ||
| - | * Prefix for lists on the DPI node (it will be used as the name of service profile on the node); | ||
| - | * Choose bridges of the border; | ||
| - | * Choose Network training to get the addresses of this profile; | ||
| - | * Specify address/ | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | Click on the button "Save changes" | ||
| - | |||
| - | <note important> | ||
| - | |||
| - | ==== Editing ISP Profile ==== | ||
| - | |||
| - | In the "ISPS & IGWS Profiles" | ||
| - | |||
| - | A modal form for creating/ | ||
| - | |||
| - | ==== Deleting ISP Profile ==== | ||
| - | |||
| - | In the "ISPS & IGWS Profiles" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | <note warning> | ||
| - | |||
| - | ==== Policing Profile ==== | ||
| - | |||
| - | Chenge to the " | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | === Editing Policing Profile === | ||
| - | |||
| - | Click on the "Edit policing" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | In the popup editing form: | ||
| - | * Enter policing description; | ||
| - | * Choose policing type TBF/HTB (form with class values will look different depending on the type selected) | ||
| - | |||
| - | < | ||
| - | You can use configuration autocomplete: | ||
| - | * For HTB type: rate=8Bps, ceil=value that was specified in autocomplete form; | ||
| - | * For TBF type: rate=value that was specified in autocomplete form. | ||
| - | </ | ||
| - | |||
| - | Th save the changes click on the button "Save profile" | ||
| - | |||
| - | <note warning> | ||
| - | |||
| - | === Deletenig Policing Profile === | ||
| - | |||
| - | There are two ways to delete the profile: by clicking " | ||
| - | ===== WEB and IP Filter ===== | ||
| - | ==== Locking Rules List ==== | ||
| - | |||
| - | Change to the "WEB and IP Filter" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ==== Creating/ | ||
| - | |||
| - | * To create new locking rule for a resource, change to the "WEB and IP Filter" | ||
| - | * To edit an existing rule change to the "WEB and IP Filter" | ||
| - | |||
| - | In the popup form: | ||
| - | * Choose the regulator; | ||
| - | * Choose the category; | ||
| - | * Enter rule public description; | ||
| - | * Enter rule hidden description; | ||
| - | | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | In the resource validation form, enter the resource and choose its type: | ||
| - | * If it is not nesessary to validate the resourse, just click on "Add to the list" button; | ||
| - | * Click on the " | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | In the subsection for binding rules to ISP profiles: | ||
| - | * If the option "Apply the rule to ISP from the list" is **disabled, | ||
| - | * If the option "Apply the rule to ISP from the list" is **enabled, | ||
| - | |||
| - | ==== Deleting the Locking Rule ==== | ||
| - | Change to the "WEB and IP Filter" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | <note warning> | ||
| - | |||
| - | ==== Domain Check ==== | ||
| - | |||
| - | Change to the "WEB and IP Filter" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | In the " | ||
| - | * SSL/TLS, locking type; | ||
| - | * Certificate information; | ||
| - | * DNS list; | ||
| - | * Recommendations about the values to use to lock this resource. | ||
| - | |||
| - | |||
| - | {{ : | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ==== Search the Database (among the blocking rules) ==== | ||
| - | |||
| - | Change to the "WEB and IP Filter" | ||
| - | |||
| - | In the "IP, CIDR, Domain, Notes" field enter the value in accordance with the prompts at the top of the page. Then choose type of search: Full Text, By Resources or By Description. Click on " | ||
| - | |||
| - | As a result, all blocking rules that match the selected search parameters will be displayed. | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ===== Whitelist ===== | ||
| - | ==== Whitelist rule list ==== | ||
| - | |||
| - | Change to the " | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ==== Creating/ | ||
| - | |||
| - | * To create a new white list rule change to the " | ||
| - | * To edit an existing rule change to the "White list" section and click on the "Edit rule" button. | ||
| - | |||
| - | In the popup form: | ||
| - | * Choose the regulator; | ||
| - | * Choose the caregory; | ||
| - | * Enter rule public description; | ||
| - | * Enter rule hidden description; | ||
| - | | ||
| - | {{ : | ||
| - | |||
| - | In the resource validation form, enter the resource and choose its type: | ||
| - | * If it is not nesessary to validate the resourse, just click on “Add to the list” button; | ||
| - | * Click on the “Check” button. Information about the resource will be displayed. It can be added to the rule locking list. To do this, click the “Add to List” button. | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | |||
| - | In the subsection for binding rules to ISP profiles: | ||
| - | |||
| - | * If the option “Apply the rule to ISP from the list” is **disabled, | ||
| - | * If the option “Apply the rule to ISP from the list” is **enabled, | ||
| - | |||
| - | ==== Deleting a white list rule ==== | ||
| - | Change to the “Whitelist” section and click on the “Edit the rule” button. | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | |||
| - | <note warning> | ||
| - | |||
| - | ==== Whitelist operating mode management ==== | ||
| - | |||
| - | Change to the “Whitelist” section -> " | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | * With the global whitelist mode enabled, the whitelist service is applied to all ISP profiles and resource lists are formed only from global whitelist rules; | ||
| - | * When the whitelist mode is enabled for a separate ISP profile, the service is applied only to ISP which has it enabled. The lists are formed only from white list rules which refer to this ISP profile; | ||
| - | * If both mode are enabled, global and separate ISP rules lists are concatenated. For other ISPs, the whitelist service is used with only the global whitelist rules. | ||
| - | |||
| - | |||
| - | ===== Database search (global) ===== | ||
| - | |||
| - | Change to the " | ||
| - | |||
| - | In the "IP, CIDR, Domain, Comment" | ||
| - | |||
| - | As a result, all blocking rules (with type specified) that match the selected search parameters will be displayed. | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ===== Task monitoring ===== | ||
| - | |||
| - | Change to the "State of the system" | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | This section displays the task queue, status and time. | ||
| - | |||
| - | To see the details of the task, click on "Task Details" | ||
| - | |||
| - | ===== Logs ===== | ||
| - | |||
| - | The logs for this section are stored in files: < | ||
| - | |||
| - | < | ||