LogLevel

{logging level}

Logging level of the component.

If the parameter value is not specified, the DefaultLogLevel parameter value from the [Root] section is used.

Default value: Notice

Log

{log type}

Logging method

ExePath

{path to file}

Path to the executable file of the component.

Default value: <opt_dir>/bin/drweb-firewall

•For Linux, Solaris: /opt/drweb.com/bin/drweb-firewall

•For FreeBSD: /usr/local/libexec/drweb.com/bin/drweb-firewall

XtablesLockPath

{path to file}

Path to the iptables (NetFilter) table blocking file. If the parameter value is not specified, the /run/xtables.lock and /var/run/xtables.lock paths are checked. If the file is not found in the specified path or default paths, when launching the component, an error occurs.

Default value: (not set)

InspectHttp

{On | Off}

Instructs whether to check the data transferred over the HTTP protocol.

Real data scanning will be performed according to the indicated scanning rules (see below).

Default value: On

InspectSmtp

{On | Off}

Instructs whether to check data transferred over SMTP protocol (if installed, the Dr.Web MailD is used).

Real data scanning will be performed according to the indicated scanning rules (see below)..

Default value: Off

InspectPop3

{On | Off}

Instructs whether to check data transferred over POP3 protocol (if installed, the Dr.Web MailD is used).

Real data scanning will be performed according to the indicated scanning rules (see below)..

Default value: Off

InspectImap

{On | Off}

Instructs whether to check data transferred over IMAP protocol (if installed, the Dr.Web MailD is used).

Real data scanning will be performed according to the indicated scanning rules (see below)..

Default value: Off

InputDivert

{Off | Auto(interface:<i_name> protected:<p_list>)}

Defines the used method of diverting incoming connections (redirecting it to the SpIDer Gate checking component).

Allowed values:

•Off—redirecting of incoming connections is disabled.

•Auto(interface:<i_name> protected:<p_list>)—redirection of incoming connections in automatic mode. Rules are controlled by Dr.Web Firewall for Linux. Connections that comes via the specified network interface <i_name> into the <p_list> port list are monitored. Port numbers in the <p_list> list are separated by commas. For example, Auto(interface:eth0 protected:80,8080).

Default value: Off

OutputDivert

{Off | Auto}

Defines the used method of diverting outgoing connections (redirecting it to the SpIDer Gate checking component).

Allowed values:

•Off—redirecting of outgoing connections is disabled.

•Auto—redirection of outgoing connections in automatic mode. Dr.Web Firewall for Linux manages the rules.

Default value: Auto

ExcludedProc

{path to file}

The list of processes which can be used as the white list of processes, i.e. list of the processes whose network activity must not be monitored.

You can specify a list as the parameter value. The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list of processes wget and curl.

1.Adding of values to the configuration file.

•Two values in one string

•Two strings (one value per a string)

2.Adding values via the command drweb-ctl cfset.

Default value: (not set)

SniCheckAddress

{Boolean}

Instructs to check the SNI host to which you are trying to connect to the SSL handshake stage, "check is listed in the black list or belongs to the blocked categories, is performed without unwrapping the SSL.

Default value: No

UnwrapSsl

{Boolean}

Instructs to check encrypted traffic transferred via the SSL/TLS connections.

Default value: No

HttpSafeSearch

{Boolean}

Instructs to use the “Safe search” option for searching engines that support this mode.

Default value: No

BlockInfectionSource

{Boolean}

Instructs to block attempted connections to websites containing malicious software (included into the InfectionSource category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockNotRecommended

{Boolean}

Instructs to block attempts of connection to non-recommended websites (included into the NotRecommended category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockAdultContent

{Boolean}

Instructs to block attempts of connection to websites containing adult content (included into the AdultContent category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockViolence

{Boolean}

Instructs to block attempts of connection to websites containing graphic violence (included into the Violence category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockWeapons

{Boolean}

Instructs to block attempts of connection to websites dedicated to weapons (included into the Weapons category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockGambling

{Boolean}

Instructs to block attempts of connection to gambling websites (included into the Gambling category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockDrugs

{Boolean}

Instructs to block attempts of connection to websites dedicated to drugs (included into the Drugs category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockObsceneLanguage

{Boolean}

Instructs to block attempts of connection to websites containing obscene language (included into the ObsceneLanguage category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockChats

{Boolean}

Instructs to block attempts of connection to chat websites (included into the Chats category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockTerrorism

{Boolean}

Instructs to block attempts of connection to websites dedicated to terrorism (included into the Terrorism category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockFreeEmail

{Boolean}

Instructs to block attempts of connection to websites of free email services (included into the FreeEmail category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockSocialNetworks

{Boolean}

Instructs to block attempts of connection to social networking websites (included into the SocialNetworks category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockDueToCopyrightNotice

{Boolean}

Instructs to block attempts of connection to websites that were added according to copyright holder requests (included into the DueToCopyrightNotice category).

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

Whitelist

{domain list}

List of domains that can be used as the white list (i.e. list of domains allowed for connection for users, even if these domains are included into blocked categories. In addition, user access will be allowed to all sub-domains of domains indicated in this list.)

The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list of domains example.com and example.net.

1.Adding of values to the configuration file.

•Two values in one string

•Two strings (one value per a string)

2.Adding values via the command drweb-ctl cfset.

Default value: (not set)

Blacklist

{domain list}

List of domains that can be used as the black list (i.e. list of domains forbidden for connection for users, even if these domains are not included into blocked categories. In addition, user access will be forbidden to all sub-domains of domains indicated in this list.)

The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list of domains example.com and example.net.

1.Adding of values to the configuration file.

•Two values in one string

•Two strings (one value per a string)

2.Adding values via the command drweb-ctl cfset.

Default value: (not set)

ScanTimeout

{time interval}

Timeout for scanning one file initiated by SpIDer Gate.

A value in the range from 1s to 1h can be specified

Default value: 30s

HeuristicAnalysis

{On | Off}

Indicates whether heuristic analysis is used for detection of unknown threats during file scanning initiated by SpIDer Gate. Heuristic analysis provides higher detection reliability but, at the same time, it increases time of virus scanning.

Action applied to threats detected by the heuristic analyzer is specified as the BlockSuspicious parameter value.

Allowed values:

•On—instructs to use heuristic analysis when scanning.

•Off—instructs not to use heuristic analysis.

Default value: On

PackerMaxLevel

{integer}

Maximum nesting level when scanning packed objects. All objects at a deeper nesting level are skipped during file scanning initiated by SpIDer Guard.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value: 8

ArchiveMaxLevel

{integer}

Maximum nesting level when scanning archives. All objects at a deeper nesting level are skipped during file scanning initiated by SpIDer Gate.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value: 8

MailMaxLevel

{integer}

Maximum nesting level when scanning email messages and mailboxes. All objects at a deeper nesting level are skipped during file scanning initiated by SpIDer Gate.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value: 8

ContainerMaxLevel

{integer}

Maximum nesting level when scanning other containers (for example, HTML pages). All objects at a deeper nesting level are skipped during file scanning initiated by SpIDer Gate.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value: 8

MaxCompressionRatio

{integer}

Maximum compression ratio of compressed/packed objects (ratio between the uncompressed size and the compressed size). If the ratio of an object exceeds the limit, this object will be skipped during file scanning procedures initiated by SpIDer Gate.

The compression ratio must not be smaller than 2.

Default value: 500

BlockKnownVirus

{Boolean}

Instructs to block the receiving or the sending of data if it contains any known threat.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockSuspicious

{Boolean}

Instructs to block receiving or sending data if it contains any unknown threat detected by the heuristic analyzer.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockAdware

{Boolean}

Instructs to block the receiving or the sending of data if it contains adware.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockDialers

{Boolean}

Instructs to block the receiving or the sending of data if it contains a dialer program.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: Yes

BlockJokes

{Boolean}

Instructs to block the receiving or the sending of data if it contains joke program.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockRiskware

{Boolean}

Instructs to block the receiving or the sending of data if it contains riskware.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockHacktools

{Boolean}

Instructs to block the receiving or the sending of data if it contains a hacktool.

For the blocking to work, you should check that within the settings there is also a rule that looks like this (see the details below):

Default value: No

BlockUnchecked

{Boolean}

Instructs to block the receiving or the sending of data if it cannot be checked.

Default value: No