LogLevel = {logging level}

Logging level.

If the parameter value is not specified, the DefaultLogLevel parameter value from the [Root] section is used.

Default value:

LogLevel = Notice

Log = {log type}

Logging method.

Default value:

Log = Auto

ExePath = {path to file}

Path to the executable file of the component.

Default value:

ExePath = <opt_dir>/bin/drweb-firewall

•For Linux:

ExePath = /opt/drweb.com/bin/drweb-firewall

•For FreeBSD:

ExePath = /usr/local/libexec/drweb.com/bin/drweb-firewall

•For Solaris:

ExePath = /opt/drweb.com/bin/drweb-firewall

InspectHttp = {On | Off}

Instructs whether to check the data transferred over the HTTP protocol.

Default value:

InspectHttp = On

InspectSmtp = {On | Off}

Instructs whether to check data transferred over SMTP protocol (if installed, the Dr.Web MailD component is used).

Default value:

InspectSmtp = Off

InspectPop3 = {On | Off}

Instructs whether to check the data transferred over the POP3 protocol (if installed, the Dr.Web MailD component is used).

Default value:

InspectPop3 = Off

InspectImap = {On | Off}

Instructs whether to check data transferred over IMAP protocol (if installed, the Dr.Web MailD component is used).

Default value:

InspectImap = Off

InputDivert = {Off | Auto(interface:<i_name> protected:<p_list>)}

Defines the used method of diverting incoming connections (redirecting it to the SpIDer Gate checking component).

Allowed values:

•Off—redirecting of incoming connections is disabled.

•Auto(interface:<i_name> protected:<p_list>)—redirection of incoming connections in automatic mode. Rules are controlled by Dr.Web Firewall for Linux. Connections that comes via the specified network interface <i_name> into the <p_list> port list are monitored. Port numbers in the <p_list> list are separated by commas. For example, Auto(interface:eth0 protected:80,8080).

Default value:

InputDivert = Off

OutputDivert = {Off | Auto}

Defines the used method of diverting outgoing connections (redirecting it to the SpIDer Gate checking component).

Allowed values:

•Off—redirecting of outgoing connections is disabled.

•Auto—redirection of outgoing connections in automatic mode. Dr.Web Firewall for Linux manages the rules.

Default value:

OutputDivert = Auto

ExcludedProc = {path to file}

The list of processes whose network activity must not be monitored.

You can specify a list as the parameter value. The values in the list must be separated with commas. The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

To block verification of the connections established bu trusted applications, you should check that within the settings there is also a rule that looks like (see the details below):

If there is no such rules, the activity of the listed processes is monitored.

Default value:

ExcludedProc =

SniCheckAddress = {boolean}

If set to true, during the SSL Handshake stage, performs a check of the SNI host to which you are trying to connect, to see if this host is listed in the black list or belongs to the blocked category. The check is performed without unwrapping the SSL.

In the current realization, the value of this variable does not influence the processing of protected traffic. To control such processing, it is necessary to create a rule containing the sni_host in and sni_category in conditions (see below).

If you change the value of this parameter with the help of the cfsetcommand of the drweb-ctl utility or with the help of the web interface, the affected dependent rules will adapt automatically.

Default value:

SniCheckAddress = No

UnwrapSsl = {Boolean}

Instructs to check encrypted traffic transferred via the SSL/TLS connections.

In the current realization, the value if this variable does not influence processing of protected traffic. To control processing, it is necessary to create a rule containing the SET Unwrap_SSL = true/false action (see below).

If you change the value of this parameter with the help of the cfsetcommand of the drweb-ctl utility or with the help of the web interface, the affected dependent rules will adapt automatically.

Default value:

UnwrapSsl = No

HttpSafeSearch = {Boolean}

Instructs to use the “Safe search” option for searching engines that support this mode.

Default value:

HttpSafeSearch = No

BlockInfectionSource = {Boolean}

Instructs to block attempted connections to websites containing malicious software (included into the InfectionSource category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockInfectionSource = Yes

BlockNotRecommended = {Boolean}

Instructs to block attempts of connection to non-recommended websites (included into the NotRecommended category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockNotRecommended = Yes

BlockAdultContent = {Boolean}

Instructs to block attempts of connection to websites containing adult content (included into the AdultContent category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockAdultContent = No

BlockViolence = {Boolean}

Instructs to block attempts of connection to websites containing graphic violence (included into the Violence category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockViolence = No

BlockWeapons = {Boolean}

Instructs to block attempts of connection to websites dedicated to weapons (included into the Weapons category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockWeapons = No

BlockGambling = {Boolean}

Instructs to block attempts of connection to gambling websites (included into the Gambling category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockGambling = No

BlockDrugs = {Boolean}

Instructs to block attempts of connection to websites dedicated to drugs (included into the Drugs category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockDrugs = No

BlockObsceneLanguage = {Boolean}

Instructs to block attempts of connection to websites containing obscene language (included into the ObsceneLanguage category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockObsceneLanguage = No

BlockChats = {Boolean}

Instructs to block attempts of connection to chat websites (included into the Chats category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockChats = No

BlockTerrorism = {Boolean}

Instructs to block attempts of connection to websites dedicated to terrorism (included into the Terrorism category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockTerrorism = No

BlockFreeEmail = {Boolean}

Instructs to block attempts of connection to websites of free email services (included into the FreeEmail category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockFreeEmail = No

BlockSocialNetworks = {Boolean}

Instructs to block attempts of connection to social networking websites (included into the SocialNetworks category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockSocialNetworks = No

BlockDueToCopyrightNotice = {Boolean}

Instructs to block attempts of connection to websites that were added according to copyright holder requests (included into the DueToCopyrightNotice category).

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockDueToCopyrightNotice = No

Whitelist = {domain list}

White list of domains. Users can access the domain included into this list even if it is included into blocked categories. Access to all sub-domains of such domains is also allowed.

To allow access to the specified domains, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

Whitelist =

Blacklist = {domain list}

Black list of domains. Users cannot access any domain included into this list even if it does not fall into any of the blocked categories. Access to all sub-domains of these domains is also forbidden.

To block specified domains, you should check that within the settings there is also a rule that looks like (see the details below):

If a host belongs to both the black list and the white list simultaneously, then access to this host will be either blocked or allowed depending on which rule (the blocking or the allowing one) appears higher (closer to the beginning) in the rules list (the rule closer to the beginning has priority).

Default value:

Blacklist =

ScanTimeout = {time interval}

Timeout for scanning one file initiated by SpIDer Gate.

A value in the range from 1s to 1h can be specified

Default value:

ScanTimeout = 30s

HeuristicAnalysis = {On | Off}

Indicates whether heuristic analysis is used for detection of unknown threats during file scanning initiated by SpIDer Gate. Heuristic analysis provides higher detection reliability but, at the same time, it increases time of virus scanning.

Action applied to threats detected by the heuristic analyzer is specified as the BlockSuspicious parameter value.

Allowed values:

•On—instructs to use heuristic analysis when scanning.

•Off—instructs not to use heuristic analysis.

Default value:

HeuristicAnalysis = On

PackerMaxLevel = {integer}

Maximum nesting level when scanning packed objects. All objects at a deeper nesting level are skipped during file scanning initiated by SpIDer Gate.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value:

PackerMaxLevel = 8

ArchiveMaxLevel = {integer}

Maximum nesting level when scanning archives. All objects at a deeper nesting level are skipped during file scanning initiated by SpIDer Gate.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value:

ArchiveMaxLevel = 8

MailMaxLevel = {integer}

Maximum nesting level when scanning email messages and mailboxes. All objects at a deeper nesting level are skipped during file scanning initiated by SpIDer Gate.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value:

MailMaxLevel = 8

ContainerMaxLevel = {integer}

Maximum nesting level when scanning other containers (for example, HTML pages). All objects at a deeper nesting level are skipped during file scanning initiated by SpIDer Gate.

A value in the range from 0 to 60 can be specified. If the value is set to 0, nested objects are not scanned.

Default value:

ContainerMaxLevel = 8

MaxCompressionRatio = {integer}

Maximum compression ratio of compressed/packed objects (ratio between the uncompressed size and the compressed size). If the ratio of an object exceeds the limit, this object will be skipped during file scanning procedures initiated by SpIDer Gate.

The compression ratio must not be smaller than 2.

Default value:

MaxCompressionRatio = 500

BlockKnownVirus = {Boolean}

Instructs to block the receiving or the sending of data if it contains any known threat.

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockKnownVirus = Yes

BlockSuspicious = {Boolean}

Instructs to block receiving or sending data if it contains any unknown threat detected by the heuristic analyzer.

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockSuspicious = Yes

BlockAdware = {Boolean}

Instructs to block the receiving or the sending of data if it contains adware.

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockAdware = Yes

BlockDialers = {Boolean}

Instructs to block the receiving or the sending of data if it contains a dialer program.

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockDialers = Yes

BlockJokes = {Boolean}

Instructs to block the receiving or the sending of data if it contains joke program.

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockJokes = No

BlockRiskware = {Boolean}

Instructs to block the receiving or the sending of data if it contains riskware.

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockRiskware = No

BlockHacktools = {Boolean}

Instructs to block the receiving or the sending of data if it contains a hacktool.

For the blocking to work, you should check that within the settings there is also a rule that looks like (see the details below):

Default value:

BlockHacktools = No

BlockUnchecked = {Boolean}

Instructs to block the receiving or the sending of data if it cannot be checked.

The value of this parameter influences processing of the rules that are impossible to evaluate to true or false because of an error. If No is specified, the rule is skipped as the rule that has not been executed. If Yes is specified, the BLOCK as BlackList action is performed.

Default value:

BlockUnchecked = No