Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revision | |||
en:dpi:dpi_components:dpiui:ulr_ui:start [2024/08/06 14:28] – elena.krasnobryzh | en:dpi:dpi_components:dpiui:ulr_ui:start [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1 | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ====== Filtering rules management interface ====== | ||
- | {{indexmenu_n> | ||
- | |||
- | ====== Universal Locking Rules UI ====== | ||
- | |||
- | ===== Introduction ===== | ||
- | Universal locking rules (ULR) UI is designed to manage filtering rules on multiple DPIs simultaneously using a graphical interface. | ||
- | |||
- | ===== Installation ===== | ||
- | Equipment or virtual machines with the following characteristics are suitable for the subsystem: | ||
- | - CPU 2.5 GHz, 2-4 cores | ||
- | - RAM from 8 GB (mainly for sphinx) | ||
- | - Hard drive (HDD) 50 GB - 250 GB | ||
- | - Cent OS 7+ operating system (we do not recommend to not install minimal, because most of the dependencies will have to be installed manually) | ||
- | - Network Card (NIC) from 10 Mbps | ||
- | |||
- | < | ||
- | </ | ||
- | |||
- | <note tip>The locking rules management interface is a special section of [[en: | ||
- | |||
- | ===== Configuration ===== | ||
- | ==== .env Configuration ==== | ||
- | The subnet configuration is handled with .env file. | ||
- | < | ||
- | |||
- | The file contents: | ||
- | < | ||
- | #Redirect URL for "White list" service | ||
- | ULR_WHITE_LIST_REDIRECT_URL=https:// | ||
- | |||
- | #The period after Ulr tasks data is deleted (days) | ||
- | ULR_QUEUE_DELETE_TASKS_DAYS_INTERVAL=1 | ||
- | |||
- | #ASN for IP-exception rules | ||
- | ULR_IP_EXCLUDE_ASN=64401 | ||
- | |||
- | #The host for blocked resources list deployment. To connect the blocked resources server. | ||
- | ULR_BLACK_LIST_DEPLOY_HOST=< | ||
- | |||
- | #The port for blocked resources list deployment. To connect the blocked resources server. | ||
- | ULR_BLACK_LIST_DEPLOY_PORT=22 | ||
- | |||
- | #Username for blocked resources list deployment. To connect the blocked resources server. | ||
- | ULR_BLACK_LIST_DEPLOY_USER=default | ||
- | |||
- | #Password for blocked resources list deployment. To connect the blocked resources server. | ||
- | ULR_BLACK_LIST_DEPLOY_PASS= | ||
- | |||
- | #To use sudo for blocked resources list deployment. (0 - do not use, 1 - use) | ||
- | ULR_BLACK_LIST_DEPLOY_SUDO=1 | ||
- | |||
- | #Black lists saving path. | ||
- | ULR_BLACK_LIST_DEPLOY_PATH=/ | ||
- | |||
- | #Log Detail Level (0 - info, 1 - debug, 2 - tracing). | ||
- | ULR_LOAD_LOG_LEVEL=0 | ||
- | </ | ||
- | |||
- | <note important> | ||
- | < | ||
- | </ | ||
- | |||
- | <note tip> | ||
- | |||
- | ==== Key Installation ==== | ||
- | |||
- | To use the Universal Locking Rules UI, you need to activate the ULR-license in DPIUI2 with a command: | ||
- | < | ||
- | |||
- | Next: | ||
- | - Enter license level: standard | ||
- | - Enter the license completion date in the Y-m-d format (e.g. 2099-12-31) | ||
- | - Enter the license password. | ||
- | |||
- | If the data is correct, a success message will be displayed: | ||
- | < | ||
- | dpiui2 ulr_lic --make=1 | ||
- | Enter level: | ||
- | > standard | ||
- | |||
- | Enter expire date in Y-m-d format: | ||
- | > 2099-12-31 | ||
- | |||
- | Enter password: | ||
- | > | ||
- | |||
- | stdClass Object | ||
- | ( | ||
- | [success] => 1 | ||
- | ) | ||
- | </ | ||
- | |||
- | ==== Roles Management ==== | ||
- | In the DPIUI2 interface visit the Administrator → Roles section. Create a new role and set read and write permissions in the ulr_admin section: | ||
- | |||
- | {{ : | ||
- | |||
- | Next, go to the Administrator-> | ||
- | |||
- | {{ : | ||
- | |||
- | After the user logs in, he is moved to the locking rules management section. | ||
- | |||
- | {{ : | ||
- | |||
- | ==== Dictionaries Configuration ==== | ||
- | |||
- | * Category Dictionary | ||
- | * Regulators Dictionary | ||
- | |||
- | <note important> | ||
- | |||
- | === Category Dictionary === | ||
- | In the Locking Rules management interface go to the Dictionaries → Categories section. | ||
- | {{ : | ||
- | |||
- | == Creating == | ||
- | Fill in the form with category name and description and click the " | ||
- | {{ : | ||
- | |||
- | == Editing == | ||
- | To edit: click on the category editing button in the categories table. In the form, change the name and/or description of the category, then click the " | ||
- | {{ : | ||
- | |||
- | == Deleting == | ||
- | Сlick on the delete category button in the categories table. In the pop-up window confirm or cancel the action. | ||
- | {{ : | ||
- | |||
- | <note warning> | ||
- | |||
- | === Regulators Dictionary === | ||
- | In the Locking Rules management interface go to the Dictionaries → Regulators section. | ||
- | {{ : | ||
- | |||
- | == Creating == | ||
- | Fill in the form with regulator name and description and click the " | ||
- | {{ : | ||
- | |||
- | == Editing == | ||
- | To edit: click on the regulator editing button in the regulators table. In the form, change the name and/or description of the regulator, then click the " | ||
- | {{ : | ||
- | |||
- | == Deleting == | ||
- | Сlick on the delete regulator button in the categories table. In the pop-up window confirm or cancel the action. | ||
- | {{ : | ||
- | |||
- | <note warning> | ||
- | |||
- | ==== IGW Profiles Management ==== | ||
- | Change to the section "ISPS & IGWS Profiles" | ||
- | |||
- | {{ : | ||
- | |||
- | === Creating === | ||
- | |||
- | To create new IGW profile change to the section "ISPS & IGWS Profiles" | ||
- | |||
- | In the form specify: | ||
- | * Profile name; | ||
- | * Operation mode (Standalone/ | ||
- | * Nodes for the profile (Node name, DPI from the list of available equipment and number of bridges) | ||
- | |||
- | {{ : | ||
- | |||
- | <note tip> | ||
- | |||
- | === Editing === | ||
- | |||
- | In the "ISPS & IGWS Profiles" | ||
- | |||
- | {{ : | ||
- | |||
- | |||
- | The IGW profile creation/ | ||
- | |||
- | === Deleting === | ||
- | |||
- | In the "ISPS & IGWS Profiles" | ||
- | |||
- | {{ : | ||
- | |||
- | |||
- | <note warning> | ||
- | |||
- | |||
- | |||
- | ===== Web Server for Global Lists Configuration ===== | ||
- | ==== Web-server ==== | ||
- | |||
- | 1. Prepare a machine with CentOS7+ installed | ||
- | |||
- | 2. Create a sudo user without password as described in [[en: | ||
- | |||
- | 3. Run the script: | ||
- | < | ||
- | rpm --import http:// | ||
- | rpm -Uvh http:// | ||
- | yum install dpiutils -y | ||
- | yum install httpd -y | ||
- | yum install unzip -y | ||
- | |||
- | mkdir / | ||
- | chmod -R 777 / | ||
- | |||
- | echo " | ||
- | < | ||
- | DocumentRoot \"/ | ||
- | |||
- | <proxy *> | ||
- | Order deny,allow | ||
- | Allow from all | ||
- | </ | ||
- | </ | ||
- | " > / | ||
- | |||
- | firewall-cmd --permanent --add-port=80/ | ||
- | firewall-cmd --reload | ||
- | |||
- | systemctl enable httpd.service | ||
- | systemctl restart httpd.service | ||
- | </ | ||
- | |||
- | 4. In dpiui2 configuration [[en: | ||
- | |||
- | 5. Specify the path to Custom lock list in the settings of all connected FastDPI servers: | ||
- | < | ||
- | # URL dictionary for blocking by HTTP (custom_url_black_list) | ||
- | custom_url_black_list=http://< | ||
- | |||
- | # Names dictionary for blocking HTTPS protocol by certificate (custom_cname_black_list) | ||
- | custom_cname_black_list=http://< | ||
- | |||
- | # IP addresses dictionary for blocking HTTPS by IP (custom_ip_black_list) | ||
- | custom_ip_black_list=http://< | ||
- | |||
- | # Host names dictionary for blocking HTTPS by SNI (custom_sni_black_list) | ||
- | custom_sni_black_list=http://< | ||
- | </ | ||
- | ===== DSCP Rules ===== | ||
- | Change to " | ||
- | |||
- | {{ : | ||
- | |||
- | === Creating === | ||
- | |||
- | In the form of rule creating: | ||
- | * Enter the name of application protocol and choose one from the list; | ||
- | * Choose the priority from the list. | ||
- | |||
- | Save the rule by clicking on "Set DSCP" button. | ||
- | |||
- | === Editing === | ||
- | |||
- | In the list of DSCP rules click on "Edit rule" button. In the popup editing form set the necessary priority and save changes by clicking on "Set DSCP" button. | ||
- | |||
- | {{ : | ||
- | |||
- | |||
- | === Deleting === | ||
- | |||
- | In the DSCP rules list click the button “Delete rule” and confirm/ | ||
- | |||
- | {{ : | ||
- | |||
- | ===== ASN Filter ===== | ||
- | Change to the "ASN Filter" | ||
- | |||
- | {{ : | ||
- | |||
- | === Creating === | ||
- | |||
- | In the form of rule creating: | ||
- | * Specify the number of AS; | ||
- | * Choose the priority from the list; | ||
- | * Enter the rule name; | ||
- | * Enter the rule description. | ||
- | |||
- | Save the rule by clicking on "Set DSCP" button. | ||
- | |||
- | === Editing === | ||
- | |||
- | In the list of DSCP in ASN direction rules click on the "Edit rule" button. If necessary, in the popup editing form: | ||
- | * choose the priority from the list; | ||
- | * Enter the rule name; | ||
- | * Enter the rule description. | ||
- | |||
- | {{ : | ||
- | |||
- | Save the changes by clicking on "Set DSCP" button. | ||
- | |||
- | === Deleting === | ||
- | In the list of DSCP in ASN direction rules click the button “Delete rule” and confirm/ | ||
- | |||
- | {{ : | ||
- | |||
- | ===== IP & ASN Excludes ===== | ||
- | Change to the "IP & ASN Excludes" | ||
- | |||
- | {{ : | ||
- | |||
- | ==== IP Excludes ==== | ||
- | |||
- | Change to the "IP & ASN Excludes" | ||
- | |||
- | {{ : | ||
- | |||
- | === Creating ==== | ||
- | |||
- | In the form of rule creating: | ||
- | * Specify IP/CIDR; | ||
- | * Enter the rule name; | ||
- | * Enter the rule descriptuin; | ||
- | |||
- | Save the rule by clicking on "Set exclusion" | ||
- | |||
- | === Editing === | ||
- | |||
- | Click on the button "Edit exclusion" | ||
- | In the form of rule editing you can change: | ||
- | * name of the rule; | ||
- | * its description. | ||
- | |||
- | {{ : | ||
- | |||
- | Save the changes by clicking on "Set DSCP" button. | ||
- | |||
- | === Deleting === | ||
- | |||
- | In the list of exclusions click the button “Delete exclusion” and confirm/ | ||
- | |||
- | {{ : | ||
- | |||
- | ==== ASN Excludes ==== | ||
- | |||
- | Change to the "IP & ASN Excludes" | ||
- | |||
- | {{ : | ||
- | |||
- | == Creating === | ||
- | |||
- | In the form of rule creating: | ||
- | * Specify AS number; | ||
- | * Enter the rule name; | ||
- | * Enter the rule descriptuin; | ||
- | |||
- | Save the changes by clicking on "Set Exclusion" | ||
- | |||
- | === Editing === | ||
- | |||
- | Click on the button "Edit exclusion" | ||
- | In the form of rule editing you can change: | ||
- | * name of the rule; | ||
- | * its description. | ||
- | |||
- | {{ : | ||
- | |||
- | Save the changes by clicking on "Set DSCP" button. | ||
- | |||
- | === Deleting === | ||
- | |||
- | In the list of exclusions click the button “Delete exclusion” and confirm/ | ||
- | |||
- | {{ : | ||
- | |||
- | ==== VIP Subscriber Management ==== | ||
- | |||
- | == VIP Subscribers and their privileges == | ||
- | |||
- | **VIP Subscriber** is a special subscriber whose traffic is passed with a dedicated priority (default is cs0) regardless of the priority settings for application protocols. | ||
- | The allocated priority is set by the special_dscp configuration parameter. See section [[en: | ||
- | The subscriber is connected through the installation of service 15 on DPI. | ||
- | |||
- | Privilege: | ||
- | * Unlimited access to applications and resources that are subject to restrictions on use. | ||
- | |||
- | == Purpose of section == | ||
- | |||
- | This section is purpose to manage VIP Subscribers. | ||
- | |||
- | === Getting started with section === | ||
- | Open section "IP & AC Exclusion" | ||
- | |||
- | {{ : | ||
- | |||
- | == Creation == | ||
- | |||
- | In the VIP Subscriber`s creating form: | ||
- | * Select the type from the drop-down list (IP/Login); | ||
- | * Enter IP or Login in the Subscriber field, depending on what you have chosen in the drop-down list; | ||
- | * You can apply the rule to an ISP from the list and select multiple ISPs or click on the " | ||
- | * If your slider is disabled on apply to specific ISPs, then the new rule will be set globally to all ISPs. | ||
- | {{ : | ||
- | |||
- | Save the VIP Subscriber by clicking the " | ||
- | |||
- | == Editing == | ||
- | |||
- | Click on the "Edit VIP Subscriber" | ||
- | In the rule editing form, you can change: | ||
- | * Application to certain ISPs from the list; | ||
- | * Remove or add ISP. | ||
- | |||
- | {{ : | ||
- | |||
- | Save your changes by clicking the " | ||
- | |||
- | == Deleting == | ||
- | |||
- | In the VIP Subscribers list, click on the " | ||
- | |||
- | {{ : | ||
- | ===== ISP Configuration ===== | ||
- | Change to the "ISPS & IGWS Profiles" | ||
- | |||
- | {{ : | ||
- | ==== Creating an ISP Profile ==== | ||
- | To create new IGW profile go to the "ISPS & IGWS Profiles" | ||
- | |||
- | In the form specify: | ||
- | * Name of ISP profile; | ||
- | * Choose the border from the list; | ||
- | * Login to be used on the DPI node; | ||
- | * Prefix for lists on the DPI node (it will be used as the name of service profile on the node); | ||
- | * Choose bridges of the border; | ||
- | * Choose Network training to get the addresses of this profile; | ||
- | * Specify address/ | ||
- | |||
- | {{ : | ||
- | |||
- | Click on the button "Save changes" | ||
- | |||
- | <note important> | ||
- | |||
- | ==== Editing ISP Profile ==== | ||
- | |||
- | In the "ISPS & IGWS Profiles" | ||
- | |||
- | A modal form for creating/ | ||
- | |||
- | ==== Deleting ISP Profile ==== | ||
- | |||
- | In the "ISPS & IGWS Profiles" | ||
- | |||
- | {{ : | ||
- | |||
- | <note warning> | ||
- | |||
- | ==== Policing Profile ==== | ||
- | |||
- | Chenge to the " | ||
- | |||
- | {{ : | ||
- | |||
- | === Editing Policing Profile === | ||
- | |||
- | Click on the "Edit policing" | ||
- | |||
- | {{ : | ||
- | |||
- | In the popup editing form: | ||
- | * Enter policing description; | ||
- | * Choose policing type TBF/HTB (form with class values will look different depending on the type selected) | ||
- | |||
- | < | ||
- | You can use configuration autocomplete: | ||
- | * For HTB type: rate=8Bps, ceil=value that was specified in autocomplete form; | ||
- | * For TBF type: rate=value that was specified in autocomplete form. | ||
- | </ | ||
- | |||
- | Th save the changes click on the button "Save profile" | ||
- | |||
- | <note warning> | ||
- | |||
- | === Deletenig Policing Profile === | ||
- | |||
- | There are two ways to delete the profile: by clicking " | ||
- | ===== WEB and IP Filter ===== | ||
- | ==== Locking Rules List ==== | ||
- | |||
- | Change to the "WEB and IP Filter" | ||
- | |||
- | {{ : | ||
- | |||
- | ==== Creating/ | ||
- | |||
- | * To create new locking rule for a resource, change to the "WEB and IP Filter" | ||
- | * To edit an existing rule change to the "WEB and IP Filter" | ||
- | |||
- | In the popup form: | ||
- | * Choose the regulator; | ||
- | * Choose the category; | ||
- | * Enter rule public description; | ||
- | * Enter rule hidden description; | ||
- | | ||
- | |||
- | {{ : | ||
- | |||
- | In the resource validation form, enter the resource and choose its type: | ||
- | * If it is not nesessary to validate the resourse, just click on "Add to the list" button; | ||
- | * Click on the " | ||
- | |||
- | {{ : | ||
- | |||
- | In the subsection for binding rules to ISP profiles: | ||
- | * If the option "Apply the rule to ISP from the list" is **disabled, | ||
- | * If the option "Apply the rule to ISP from the list" is **enabled, | ||
- | |||
- | ==== Deleting the Locking Rule ==== | ||
- | Change to the "WEB and IP Filter" | ||
- | |||
- | {{ : | ||
- | |||
- | <note warning> | ||
- | |||
- | ==== Domain Check ==== | ||
- | |||
- | Change to the "WEB and IP Filter" | ||
- | |||
- | {{ : | ||
- | |||
- | In the " | ||
- | * SSL/TLS, locking type; | ||
- | * Certificate information; | ||
- | * DNS list; | ||
- | * Recommendations about the values to use to lock this resource. | ||
- | |||
- | |||
- | {{ : | ||
- | |||
- | {{ : | ||
- | |||
- | ==== Search the Database (among the blocking rules) ==== | ||
- | |||
- | Change to the "WEB and IP Filter" | ||
- | |||
- | In the "IP, CIDR, Domain, Notes" field enter the value in accordance with the prompts at the top of the page. Then choose type of search: Full Text, By Resources or By Description. Click on " | ||
- | |||
- | As a result, all blocking rules that match the selected search parameters will be displayed. | ||
- | |||
- | {{ : | ||
- | |||
- | ===== Whitelist ===== | ||
- | ==== Whitelist rule list ==== | ||
- | |||
- | Change to the " | ||
- | |||
- | {{ : | ||
- | |||
- | ==== Creating/ | ||
- | |||
- | * To create a new white list rule change to the " | ||
- | * To edit an existing rule change to the "White list" section and click on the "Edit rule" button. | ||
- | |||
- | In the popup form: | ||
- | * Choose the regulator; | ||
- | * Choose the caregory; | ||
- | * Enter rule public description; | ||
- | * Enter rule hidden description; | ||
- | | ||
- | {{ : | ||
- | |||
- | In the resource validation form, enter the resource and choose its type: | ||
- | * If it is not nesessary to validate the resourse, just click on “Add to the list” button; | ||
- | * Click on the “Check” button. Information about the resource will be displayed. It can be added to the rule locking list. To do this, click the “Add to List” button. | ||
- | |||
- | {{ : | ||
- | |||
- | |||
- | In the subsection for binding rules to ISP profiles: | ||
- | |||
- | * If the option “Apply the rule to ISP from the list” is **disabled, | ||
- | * If the option “Apply the rule to ISP from the list” is **enabled, | ||
- | |||
- | ==== Deleting a white list rule ==== | ||
- | Change to the “Whitelist” section and click on the “Edit the rule” button. | ||
- | |||
- | {{ : | ||
- | |||
- | |||
- | <note warning> | ||
- | |||
- | ==== Whitelist operating mode management ==== | ||
- | |||
- | Change to the “Whitelist” section -> " | ||
- | |||
- | {{ : | ||
- | |||
- | * With the global whitelist mode enabled, the whitelist service is applied to all ISP profiles and resource lists are formed only from global whitelist rules; | ||
- | * When the whitelist mode is enabled for a separate ISP profile, the service is applied only to ISP which has it enabled. The lists are formed only from white list rules which refer to this ISP profile; | ||
- | * If both mode are enabled, global and separate ISP rules lists are concatenated. For other ISPs, the whitelist service is used with only the global whitelist rules. | ||
- | |||
- | |||
- | ===== Database search (global) ===== | ||
- | |||
- | Change to the " | ||
- | |||
- | In the "IP, CIDR, Domain, Comment" | ||
- | |||
- | As a result, all blocking rules (with type specified) that match the selected search parameters will be displayed. | ||
- | |||
- | {{ : | ||
- | |||
- | ===== Task monitoring ===== | ||
- | |||
- | Change to the "State of the system" | ||
- | |||
- | {{ : | ||
- | |||
- | This section displays the task queue, status and time. | ||
- | |||
- | To see the details of the task, click on "Task Details" | ||
- | |||
- | ===== Logs ===== | ||
- | |||
- | The logs for this section are stored in files: < | ||
- | |||
- | < | ||