Threat protection and filtering

The Security tab's Protection group has four ways to keep threats out, and the Organization group copies settings between firewalls:

Each section edits a draft. Click Turn on (or Save once it's on) to send it, or Discard changes to throw it away. See How changes work.

#Threat protection

Threat protection is the firewall's intrusion detection and prevention (IDS/IPS). It checks traffic passing through the firewall against rules it downloads every day from the free ET Open and abuse.ch feeds. It can alert you only, or also block what it finds.

The section shows its status (Off, Alerting, Blocking, or Not running), how many rules are in use, the CPU and memory it uses, and when the rules were last downloaded.

#Turn on threat protection

1. Open Security > Threat protection and tick Turn on threat protection.
2. Under When it finds a threat, choose:
   • Alert only: records threats without slowing the firewall down. A good place to start.
   • Alert and block: also drops the traffic.
3. Under How much to block, choose Low, Medium, or High. Medium suits most networks.
4. Under What to watch for, tick the kinds of threat: Malware, Known attackers, Exploits and attacks, Phishing and harmful websites, Scans, Cryptocurrency mining, and DNS over HTTPS and tunnels (alerts only, never blocks).
5. Under Interfaces to watch, tick the WAN, plus any internal networks you want watched (up to 16).
6. Keep Download new rules every day ticked.
7. Click Save.

The firewall downloads the rules and restarts threat protection. This can take a few minutes, and it carries on if you leave the page.

If ReadyView says hardware offloading is still on, turn off checksum, segmentation, and large receive offloading under Interfaces > Settings on the firewall. Threat protection can't inspect traffic properly with them on.

#What it found

When threat protection is on, What it found shows the last 24 hours or 7 days: how many threats were found and blocked, a chart by severity, the most frequent threats, kinds of threat, top sources and destinations, and a Latest threats table you can filter by severity.

#Threat alerts

Under Alerts in the section, set:

• Alert when threats are found: at least a number of threats, of a severity (High, Medium or high, or Any), within a number of minutes;
• Alert when threat protection stops running: after a number of minutes.

Click Save alerts. These are saved with the firewall's other alerts.

If the status shows Not running, click Update rules now. If it stays stopped, check Services > Intrusion Detection > Log File on the firewall.

#Blocklists

Blocklists block traffic to and from known malicious addresses on every interface, ahead of the firewall's other rules. Choose from:

• Spamhaus DROP: networks hijacked or run by spammers and criminals.
• abuse.ch Feodo Tracker: botnet command servers. It's often short or empty.
• Emerging Threats compromised hosts: hosts known to be compromised and used in attacks.

The firewall downloads each list every few hours. Blocklists never block private, link-local, or the firewall's own networks, and they leave out entries too broad to block safely.

#Turn on blocklists

1. Open Security > Blocklists and tick the lists you want.
2. Tick Block traffic to and from the lists ticked.
3. Click Turn on.

Each list then shows how many networks it holds, when it was last updated, and how many packets it has blocked. Blocked traffic also shows in the live log.

To pause without losing your choice, untick Block traffic to and from the lists ticked and save. Turn off and remove deletes the blocklists' rules and aliases from the firewall.

If the status says Not fully in place, someone changed or turned off one of the blocklists' rules or aliases on the firewall. Click Save to put it back.

#Regions

The region filter blocks whole countries, or allows only the countries you choose, ahead of the firewall's other rules.

#Add a GeoIP database first

The firewall needs a GeoIP database to know which country an address is in. Without one, ReadyView says the region filter blocks nothing. To add one:

1. Get a free country database download link: MaxMind GeoLite2 Country (CSV) with your licence key, or IPinfo with your token.
2. In the firewall's web interface, open Firewall > Aliases > GeoIP settings, paste the link into URL, and click Apply.
3. Come back to ReadyView and click Refresh.

The link carries your licence key, so you enter it on the firewall only. ReadyView never sees it.

#Turn on the region filter

1. Open Security > Regions and use Find a country to add countries.
2. Choose the Mode:
   • Block these: traffic to and from the countries chosen is blocked.
   • Allow only these: every public address outside the countries chosen is blocked. Private addresses and the firewall's own traffic always pass. Cloud services your devices use that are hosted in other countries stop working too.
3. Optionally tick Block incoming only. Devices can still reach any country, and the replies come back.
4. Optionally list addresses under Never blocked, up to 256, such as a partner's office. In Block these mode, an address in a blocked country stays blocked even when it's listed here.
5. Tick Turn the region filter on and click Turn on.

Most blocked countries shows where recent blocked connections came from.

#DNS filtering

The DNS filter blocks websites by category or by domain, using the firewall's DNS resolver (Unbound DNS). Blocked domains get the answer 0.0.0.0, so the site doesn't load.

#Turn on the DNS filter

1. Open Security > DNS filtering and tick Filter DNS on this firewall.
2. Under Categories to block, tick any of: Ads and trackers, Malware and phishing, Adult content, Gambling, Social media, and VPNs, proxies and DNS over HTTPS.
3. Optionally list domains, one per line, up to 250 each. Subdomains are included:
   • Never blocked always wins over the categories. Use it for a site a category blocks by mistake.
   • Always blocked blocks a domain no category covers.
4. Click Save.

The firewall downloads the category lists, which can take a few minutes. To pause the filter but keep its settings, untick Filter DNS on this firewall and save.

The DNS filter needs Unbound DNS turned on under Services > Unbound DNS > General on the firewall. A firewall that answers DNS with Dnsmasq instead isn't filtered.

#Who is filtered

Only devices that use the firewall as their DNS server are filtered. Devices set to another DNS server, or using DNS over HTTPS (DoH) or DNS over TLS, get around it, unless you turn on the guard below.

For per-group filtering, such as blocking social media for students only, use a group policy.

#Stop devices from getting around the filter

With plugin 1.14 or later, tick Stop devices from getting around the filter. On every network except the WAN, the firewall then:

• answers DNS requests sent to other servers itself;
• blocks DNS over TLS (port 853);
• blocks the public DNS over HTTPS services (Cloudflare, Google, Quad9, and others) by address and name, from lists it checks daily;
• tells Firefox to turn off its built-in DNS over HTTPS, and tells Apple devices that iCloud Private Relay isn't available on this network.

A VPN, or a DNS over HTTPS service the firewall doesn't know, still gets around it. Also block the VPNs, proxies and DNS over HTTPS category to cover more.

Under Devices that may use their own DNS, list up to 64 addresses or networks the guard leaves alone, such as a server that needs its own resolver.

The section shows, per network, whether the guard is In place, and how many attempts it blocked recently and from which devices. A new network gets the guard within about a minute.

#Fleet templates

Fleet templates copy this firewall's aliases and region filter to other firewalls in your organization, or save them as a template to apply later. Port forwards, filter rules, and the firewall's own aliases (URL tables, GeoIP, and others) aren't copied, because they belong to each site.

#Copy settings to other firewalls

1. Open Security > Fleet templates and click Choose what to copy.
2. Choose From this firewall or a Saved template.
3. Under What to copy, tick the aliases (up to 49) and the Region filter. Aliases that another alias needs are marked Needed by a group.
4. Optionally enter a Template name and click Save as template.
5. Under Firewalls to change, pick up to 20 firewalls.
6. Choose what happens If a firewall already has an alias by that name with something else in it: Update it, Skip it, or Leave that firewall alone (the default).
7. Click Preview to see what each firewall would do: Will change, Up to date, Conflict, Changes off, Agent too old, or Offline.
8. Click Apply and confirm.

Each firewall takes its change whole or not at all. Leaving the page doesn't stop it, and each firewall's result is recorded in your organization's Logs.

Applying needs permission to change firewall rules, plus permission to apply templates for a saved template. Saving and deleting templates need their own template permissions.

To update or restart several firewalls at once, see Firmware on several firewalls.