DOCSEARCHbyAlgolia
Submit Docs

NethSecurity Administrator Manual

website·Indexed 32 days ago

https://docs.nethsecurity.org

Comprehensive documentation for NethSecurity, covering installation on bare metal and VPS, system requirements, and network security configuration. Includes guides for firewall management, IPsec tunnels, Snort 3 IPS, Threat Shield DNS, Hotspot captive portals, and the Unified Configuration Interface (UCI). Provides technical details on user databases, high availability, and advanced CLI tools like softflowd and speedtest.

Tokens
60K
Snippets
165
Records
459
Agent score
66%

What's inside NethSecurity

  1. Overview of Deep Packet Inspection (DPI) filtering

    NethSecurity utilizes the Netify Agent (leveraging nDPI) to perform Deep Packet Inspection. The system identifies network protocols and applications, assigns labels to matching connections via the Netify flow actions plugin, and then uses nft rules to either block those connections or adjust their priority (DSCP).

  2. Overview of Firewall Objects

    Firewall objects are predefined sets of network addresses used to simplify firewall configuration. They allow administrators to group related IP addresses, networks, or domain names into reusable units. Updating an object automatically updates all associated firewall rules, port forwards, and network policies.

    Supported object types include:

    • Static Leases (DHCP Reservations)
    • DNS Records
    • VPN Users
    • Host Sets (groups of IPs, networks, or ranges)
    • Domain Sets (collections of domain names)

  3. Overview of NethSecurity Hotspot features

    The NethSecurity Hotspot service provides internet connectivity via Wi-Fi to casual users through a captive portal. It supports multiple authentication methods including Social Login, SMS, Email, and Voucher codes. Key features include network isolation between corporate and guest traffic, a customizable captive portal, AutoLogin support, and a Hotspot manager with tiered access (admin, customer, desk).

  4. Overview of NethSecurity UTM features

    NethSecurity is an OpenWrt-based Unified Threat Management (UTM) solution designed for SMBs and enterprise organizations. It provides a comprehensive suite of security and network management tools, including:

    Security Features:

    • Firewall: Stateful packet inspection and filtering to prevent unauthorized access.
    • DNS Content Filtering: Blocks access to inappropriate or malicious websites.
    • Deep Packet Inspection (DPI): Utilizes Netifyd to inspect packet contents and identify unwanted traffic.
    • Icaro Hotspot: A captive portal solution for managing and authenticating wireless network users.
    • VPN Support: Supports OpenVPN, IPSec, and Wireguard for secure tunneling.
    • Remote Controller: Allows central management of multiple NethSecurity installations from a single interface.

    Network Features:

    • Quality of Service (QoS): Prioritizes critical application traffic to ensure bandwidth availability.
    • IPv6 Support: Full support for the IPv6 internet protocol.

  5. Overview of NethSecurity Unified Threat Management (UTM)

    NethSecurity provides a Unified Threat Management (UTM) solution built on OpenWrt and supported by the NethServer community. It integrates the following security and networking features into a single solution: firewall, multi-WAN support, content filtering, deep packet inspection (DPI), intrusion prevention (IPS), and VPN capabilities.

  6. Overview of NethSecurity Unified Configuration Interface (UCI)

    UCI (Unified Configuration Interface) is a centralized configuration management system used in NethSecurity. It provides a unified approach to system configuration via a command-line interface and standardized database files.

    Key characteristics include:

    • Centralized Storage: All configurations are located in /etc/config/.
    • Database-driven: Configurations are stored in structured files.
    • No Built-in Validation: UCI executes commands without safety checks; users must have system knowledge to avoid misconfiguration.
    • Three-phase Workflow: The standard process for applying changes is Modify $\rightarrow$ Commit $\rightarrow$ Restart/Reload.

  7. Overview of Netify Informatics integration

    Netify Informatics is a third-party cloud service that uses analytics and AI to convert local DPI (Deep Packet Inspection) metadata from NethSecurity into network intelligence. It provides insights into device discovery, bandwidth monitoring, risk and reputation analysis, regulatory compliance, geolocation, and audit/forensics. The service receives data from netifyd, the NethSecurity DPI engine, which is enabled by default on the firewall.

  8. Overview of NethSecurity 8 High Availability (HA)

    NethSecurity 8 natively supports High Availability (HA) in active/passive mode. This configuration uses two nodes (primary and secondary) to ensure firewall continuity and traffic management during failures or maintenance of the primary node. Unlike NethSecurity 7.9, installation and configuration can be performed autonomously by the user without requiring equipment to be sent to Nethesis laboratories.

  9. Overview of NethSecurity monitoring views

    NethSecurity provides three distinct monitoring views to track firewall performance and health:

    1. Real-time monitoring: Uses Telegraf, Netifyd, and logs to provide immediate insights into traffic, VPN connections, and security events. Data is stored in RAM and resets upon machine reboot.
    2. Historical monitoring: Telegraf writes data to VictoriaMetrics for local persistent storage. Available from NethSecurity 8.8 without a subscription.
    3. Remote monitoring: Metrics are stored remotely via Prometheus when the firewall is connected to a controller. This requires a valid subscription for both the firewall and the controller.

  10. Overview of Cerbeyra VPN Probe for NethSecurity 8

    Cerbeyra is a security platform providing Vulnerability Assessment and Asset Management. To perform scans, Cerbeyra requires a VPN tunnel into the target network. NethSecurity 8 can be configured as a VPN probe (OpenVPN server) to facilitate this. The configuration script automates the creation of the OpenVPN server, client configuration generation, and firewall rule setup. By default, the first configured LAN is scanned; other networks can be added via the 'Local Networks' field of the cerbeyra OpenVPN tunnel server in the NethSecurity UI.

  12. Overview of NethSecurity Threat Shield

    Threat Shield is a security module available on NethSecurity 8 and NethServer Enterprise 7.9 (including NethService and NethVoice). It improves network security by blocking traffic to and from malicious destinations using two types of blacklists:

    • IP Blacklist: Blocks all connections originating from or destined to specific IP addresses. This is the most effective method for combating malicious host traffic.
    • DNS Blacklist: Intercepts client DNS requests and blocks connections to blacklisted domains.

    Deployment Scope:

    • When activated on NethService/NethVoice, it protects only the specific server (suitable for cloud environments without a perimeter firewall).
    • When activated on NethSecurity, it protects the entire network.