Filter Cluster¶

The functionality of Wanguard Filter is briefly described in the Choosing a Method of DDoS Mitigation chapter, and also in the Configuration » Components » Packet Filter chapter. Filter Cluster receives traffic information from Packet Filter and/or from Flow Filter.

To add a Filter Cluster, click the [+] button found in the title bar of the Configuration » Components panel. To configure an existing Filter Cluster, go to Configuration » Components and click its name.

Every parameter is already documented in Configuration » Components » Packet Filter, apart from:

● Apply Rules By – Select where to apply the filtering rules detected by the Filter Cluster:

○ Associated Filters – Filtering rules are applied on each server running an associated Filter

○ Filter Cluster – Filtering rules are applied only on the server running the Filter Cluster

● Associated Filters – Select the Filters that should be aggregated by the Filter Cluster. The associated Filters are launched by the Filter Cluster instance and need not be launched individually via a Response

Enable the Filter Cluster by clicking the small on/off switch button displayed next to its name in Configuration » Components.

An instance of the Filter Cluster is launched when a traffic anomaly triggers the Response action “Detect filtering rules and mitigate the attack with Wanguard Filter”.