Wiki of WFilter NG Firewall - User contributions [en]

Wfquery

2026-07-07T09:15:19Z

WFilter:

{{DISPLAYTITLE:Internet Usage Monitoring}}
== Internet Usage Monitoring ==
The "Internet Usage Monitoring" module records internet activities, including:
* Web Surf
* Web Post
* Outgoing Emails
* Incoming Emails
* File Upload History
* File Download History
* FTP/Telnet Sessions
* IP-MAC History
* Connection Details

This module works both in "gateway mode" and "bridge mode". Enterprise license is required.

[[File:Wfrecorder_query1.png|800px]]

[[File:Wfrecorder_query2.png|800px]]

[[File:Wfrecorder_query3.png|800px]]

[[File:Wfrecorder_queryftp.png|800px]]

[[File:Wfrecorder_querysessions.png|800px]]

[[File:Wfrecorder_querysessions.png|800px]]

[[File:Wfrecorder_queryconnections.png|800px]]

== Recording Policy ==

For every client, multiple policies can be applied. For example:
* A policy: record web surfing for a whole subnet.
* B policy: enable "email recording" for a special IP in this subnet.
For this ip, both "web surfing recording" and "email recording" will be enabled.

Detailed "recording policy" settings are described in below.

=== Web Recording ===
* '''Web Surf''': record titles of visited web pages for http websites. For https websites, only domains will be recorded in default. To record https webpages, please check [[Sslinspect|"SSL Inspector"]].
* '''Web Post''': record web post content for http websites. To record https websites posts, please check [[Sslinspect|"SSL Inspector"]].
* '''Web Post Size Limit''': no recording of web post exceeds size limit.
* '''Smart Filter''': With this feature enabled, WFilter will not record visits by non-human. (Not 100% accurate)
* '''Domains Exception''': no recording of domains in the exception list. Wildcards "*?" are supported.

[[File:Wfrecorder_setweb_en2.png|650px]]

=== Email Recording ===

[[File:Wfrecorder_sermail_en.jpg|650px]]

* Emails supported: SMTP, POP3, IMAP4 and outgoing web-based emails.
* For emails exceed size limit, only subject/from/to will be recorded.
* To record ssl emails(SMTP/POP/IMAP over SSL), please check [[Sslinspect|"SSL Inspector"]].

=== File Transfers ===

[[File:Wfrecorder_settings_ftp.png|650px]]

* File transfers supported: FTP upload, FTP download, Web download, Web upload.
* WFilter only records filenames/URLs of downloaded files. While full file content can be recorded for uploading files.
* For uploading files exceed size limit, only filenames can be recorded.
* To record files via https, you need to enable "HTTPS Inspector".

=== Others ===

[[File:Wfrecorder_settings_other.png|650px]]

Options to enable IM acounts and FTP/Telnet sessions.
* Only QQ messenger IDs can be recorded.
* When "FTP/Telnet Sessions" is enabled, sent FTP/Telnet commands can be recorded.
* IP-MAC History: daily IP-MAC address history.
* Connections: detail of TCP connections history.

== Advanced Settings ==

=== System ===
* '''IPv6''': enable recording of IPv6 activities.
* '''Database Commit''': the database commit frequency.
* '''Record local visits to below Hosts''': local traffic to these hosts will be recorded.
* '''Additional Webmail Domains''': Custom webmails to be recorded.
* '''Protocol Ports''', customize protocols ports for HTTP, HTTPS, POP3, IMAP4 and SMTP.

[[File:Wfrecorder_advanced_en2.png|650px]]

Wfquery

2026-07-07T09:13:58Z

WFilter: /* System */

{{DISPLAYTITLE:Internet Usage Monitoring}}
== Internet Usage Monitoring ==
The "Internet Usage Monitoring" module records internet activities, including:
* Web Surf
* Web Post
* Outgoing Emails
* Incoming Emails
* File Upload History
* File Download History
* IM Accounts
* FTP/Telnet Sessions
* IP-MAC History
* Connection Details

This module works both in "gateway mode" and "bridge mode". Enterprise license is required.

[[File:Wfrecorder_query1.png|800px]]

[[File:Wfrecorder_query2.png|800px]]

[[File:Wfrecorder_query3.png|800px]]

[[File:Wfrecorder_queryftp.png|800px]]

[[File:Wfrecorder_queryim.png|800px]]

[[File:Wfrecorder_querysessions.png|800px]]

[[File:Wfrecorder_querysessions.png|800px]]

[[File:Wfrecorder_queryconnections.png|800px]]

== Recording Policy ==

For every client, multiple policies can be applied. For example:
* A policy: record web surfing for a whole subnet.
* B policy: enable "email recording" for a special IP in this subnet.
For this ip, both "web surfing recording" and "email recording" will be enabled.

Detailed "recording policy" settings are described in below.

=== Web Recording ===
* '''Web Surf''': record titles of visited web pages for http websites. For https websites, only domains will be recorded in default. To record https webpages, please check [[Sslinspect|"SSL Inspector"]].
* '''Web Post''': record web post content for http websites. To record https websites posts, please check [[Sslinspect|"SSL Inspector"]].
* '''Web Post Size Limit''': no recording of web post exceeds size limit.
* '''Smart Filter''': With this feature enabled, WFilter will not record visits by non-human. (Not 100% accurate)
* '''Domains Exception''': no recording of domains in the exception list. Wildcards "*?" are supported.

[[File:Wfrecorder_setweb_en2.png|650px]]

=== Email Recording ===

[[File:Wfrecorder_sermail_en.jpg|650px]]

* Emails supported: SMTP, POP3, IMAP4 and outgoing web-based emails.
* For emails exceed size limit, only subject/from/to will be recorded.
* To record ssl emails(SMTP/POP/IMAP over SSL), please check [[Sslinspect|"SSL Inspector"]].

=== File Transfers ===

[[File:Wfrecorder_settings_ftp.png|650px]]

* File transfers supported: FTP upload, FTP download, Web download, Web upload.
* WFilter only records filenames/URLs of downloaded files. While full file content can be recorded for uploading files.
* For uploading files exceed size limit, only filenames can be recorded.
* To record files via https, you need to enable "HTTPS Inspector".

=== Others ===

[[File:Wfrecorder_settings_other.png|650px]]

Options to enable IM acounts and FTP/Telnet sessions.
* Only QQ messenger IDs can be recorded.
* When "FTP/Telnet Sessions" is enabled, sent FTP/Telnet commands can be recorded.
* IP-MAC History: daily IP-MAC address history.
* Connections: detail of TCP connections history.

== Advanced Settings ==

=== System ===
* '''IPv6''': enable recording of IPv6 activities.
* '''Database Commit''': the database commit frequency.
* '''Record local visits to below Hosts''': local traffic to these hosts will be recorded.
* '''Additional Webmail Domains''': Custom webmails to be recorded.
* '''Protocol Ports''', customize protocols ports for HTTP, HTTPS, POP3, IMAP4 and SMTP.

[[File:Wfrecorder_advanced_en2.png]]

File:Wfrecorder advanced en2.png

2026-07-07T09:11:56Z

WFilter: WFilter uploaded a new version of "File:Wfrecorder advanced en2.png"

IKEv2

2026-06-09T07:10:50Z

WFilter:

== IKEv2 Server ==

IKEv2 Server provides a dial-in VPN service based on IKEv2+MSCHAPv2 authentication.

== Settings ==

IKEv2 requires public internet IP address(es), as shown in below figure：
* WAN IP: choose the WAN ip address to run IKEv2 service on.
* VPN Subnet: a subnet for VPN clients. For example: 10.7.1.0/24
* Push Route: defines routing for clients.

[[File:ikev2_server.png|800px]]

To allow IKEv2 clients to access network, you also need to setup firewall policies in Firewall->Rules.

[[File:ikev2_firewall.png|800px]]

== Client Setup ==

First you need to download the CA certificate in "VPN - Open VPN server" and install it to the client devices. You also need to add VPN users in "User Auth -> Accounts". Then you shall be able to login IKEv2 VPN clients.

[[Category:VPN]]

File:Ikev2 firewall.png

2026-06-09T07:10:05Z

WFilter:

File:Ikev2 server.png

2026-06-09T07:08:26Z

WFilter:

IKEv2

2026-06-09T07:00:44Z

WFilter: Created page with "== IKEv2 Server == IKEv2 Server provides a dial-in VPN service based on IKEv2+MSCHAPv2 authentication. == Settings == IKEv2 requires public internet IP address(es), as show..."

== IKEv2 Server ==

IKEv2 Server provides a dial-in VPN service based on IKEv2+MSCHAPv2 authentication.

== Settings ==

IKEv2 requires public internet IP address(es), as shown in below figure：
* WAN IP: choose the WAN ip address to provide IKEv2 service.
* VPN Subnet: a subnet for VPN clients. For example: 10.7.1.0/24
* Push Route: defines routing for clients.

[[File:ikev2_server.png|800px]]

To allow IKEv2 clients to access network, you also need to setup firewall policies in Firewall->Rules.

[[File:ikev2_firewall.png|800px]]

== Client Setup ==

First you need to download the CA certificate in "VPN - Open VPN server" and install it to the client devices. You also need to add VPN users in "User Auth -> Accounts". Then you shall be able to login IKEv2 VPN clients.

[[Category:VPN]]

File:Ikev2.png

2026-06-09T06:26:09Z

WFilter:

VPN

2026-06-09T06:26:01Z

WFilter:

{{DISPLAYTITLE:VPN}}
* [[File:pptpvpn1.png]] [[pptpvpn|PPTP / L2TP]]
* [[File:ipsecvpn1.png]] [[ipsecvpn|IPSec Tunnels]]
* [[File:openvpn1.png]] [[Openvpn|OpenVPN]]
* [[File:webvpn1.png]] [[WebVPN|WebVPN]]
* [[File:sdwan1.png]] [[SD-WAN|SD-WAN]]
* [[File:zerotier1.png]] [[ZeroTier|ZeroTier]]
* [[File:ikev2.png]] [[IKEv2|IKEv2 Server]]
* [[File:vpnclient1.png]] [[vpnclient|VPN Client]]
* [[Firewall_for_vpn|VPN related firewall settings]]

[[Category:VPN]]

File:Wfilter event3.png

2026-05-18T07:21:19Z

WFilter:

File:Wfilter event2.png

2026-05-18T07:21:09Z

WFilter:

File:Wfilter event1.png

2026-05-18T07:20:15Z

WFilter:

Event

2026-05-18T07:20:06Z

WFilter: Created page with "{{DISPLAYTITLE:Events}} "Events List" is used to record various events that occur during system operation. There are three types of event information: "Information", "Alert" ..."

{{DISPLAYTITLE:Events}}

"Events List" is used to record various events that occur during system operation. There are three types of event information: "Information", "Alert" and "Error":

* Information: Log-type event information, such as operation logs, restarts, upgrades, etc.
* Alert: Warning events that require attention.
* Error: Critical events that require immediate action.

= Settings =

* Events to be recorded
* Admin Email(s): forward events to admin email boxes. SMTP settings shall be enabled in "Config->System->Email".
* Events to be forwarded: forward events to a syslog server or webhook service.

[[File: wfilter_event1.png|650px]]

[[File: wfilter_event2.png|450px]]

[[File: wfilter_event3.png|450px]]

Maccd

2026-04-01T08:30:34Z

WFilter:

{{DISPLAYTITLE:MAC Detector}}
== MAC Detector ==

"MAC Detector" can gather client's physical MAC addresses via SNMP protocol. With "MAC Detector" enabled, you can:
* Set access policy by MAC addresses.
* Set IP-MAC binding in a multiple-segments network.
* Show real MAC addresses in "Real-time Bandwidth".
* Show real MAC addresses in "Internet Usage".

== Settings ==
== SNMP Commands ==
"MAC Detector" use snmpwalk commands to send SNMP query to manageable devices. Usually, the snmpwalk commands are sent to routing devices, for example: core three-layer switch, or manageable wireless AP.
* "SNMP Commands": snmpwalk commands be sent to the manageable devices. Multiple commands are supported.
* "Result Format": a regular expression which matches ONE record row.

=== Example ===
Suppose the core three layer switch has ip address "192.168.1.2", the "SNMP Command" is:

''snmpwalk -v 2c -c public 192.168.1.2 ipNetToPhysicalPhysAddress''

"ipNetToPhysicalPhysAddress" can retrieve both IPv4 and IPv6 addresses, you also can use "ipNetToMediaPhysAddress" for IPv4 only. The real return message is:

''IP-MIB::ipNetToPhysicalPhysAddress.9.192.168.1.1 = STRING: 0:6:f6:bf:8b:cc''

''IP-MIB::ipNetToPhysicalPhysAddress.9.192.168.1.11 = STRING: ae:15:53:a0:9b:7f''
...

To match every return rows, we configure the "result format" as:

''IP-MIB::ipNetToPhysicalPhysAddress\.\d+.*''

The "MAC Detector" will use the "result format" to get every record and retrieve the mac and ip information.

[[File:Maccd00.jpg|750px]]

=== Test ===

You may click "test" to test the SNMP commands in the list.

[[File:Maccd01.jpg|750px]]

== FAQ ==

File:Faq account005.png

2025-08-20T02:58:39Z

WFilter:

Account

2025-08-20T02:58:17Z

WFilter: /* Password Complexity and Expiry */

{{DISPLAYTITLE:Accounts}}
== Introduction ==

This module defines WFilter NGF's local accounts of, which can be used for:
* [[Pppoe|PPPoE]]
* [[Webauth|Web Auth]]
* [[VPN]]
* Set access policy by users.
* Record internet activity by users.
For example, you can choose usernames in "Applied to" targets for polices:

[[File:Faq_en_account002.png|600px]]

== New Local Account ==

You need to configure account's username, password, valid date, group, sessions, mac binding, access priviledge and pppoe properties.
* Supported access type:
** PPPoE: allow this user to access WFilter NGF's pppoe service. Please check [[Pppoe|PPPoE]] for details.
** VPN: allow this user to connect to vpn service. Please check [[VPN]] for details.
** Web: allow this user to authenticate via web auth. Please check [[Webauth|Web Auth]] for details.
** Static IP: bind static IP to an username.
* "Concurrent Logins": maximum concurrent sessions of this user. No limit by default.
* "MAC Binding": supports "dynamic binding" and "static binding".
** Static: this user can only be connected from the bound MAC addresses. Multiple MACs are separated by commas.
** Dynamic1: bind this user to MAC address of the first time connection.
** Dynamic3: automatically bind the first three authenticated mac addresses.
** Dynamic5: automatically bind the first five authenticated mac addresses.
** Automatic IP-MAC binding: automatically add IP-MAC addresses to "IP-MAC binding".
* Expired users can not access any authentication service.
* PPPoE properties are only valid to PPPoE users.
** "Bandwidth Limit": limit this user's real-time bandwidth rate.
** "Static IP": assign a static ip address to this user when this user is connected via pppoe or VPN.
[[File:Faq_en_account001.png|600px]]

== Third Party Accounts ==
Users authenticated via third party authentication services will be listed. You can click "delete" to delete expired users.
* Third party authentication
** "Email Authentication".
** "Ldap Authentication".
** "Radius Authentication".
* Access Type:
** webauth: access via [[webauth|Web Auth]].
** pppoe: access via [[pppoe|PPPoE]].
** vpn: access via [[VPN|VPN]].

[[File:Faq_account004.png|800px]]

== Login History ==
Login history of users.

[[File:Faq_account003.png|800px]]

== Settings ==
=== Password Complexity and Expiry ===
* Password Complexity. The following four password complexity requirements are supported:
** None: No complexity requirements for passwords.
** Basic level: The minimum length is 6. Common weak passwords, keyboard character sequences, repeated keys more than 3 times, and account name information are not allowed.
** Intermediate level: On the basis of meeting the basic level, it also requires a minimum length of 8 and must contain 3 or more types of characters (uppercase letters, lowercase letters, numbers, special characters).
** High strength: On the basis of meeting the basic level, it also requires a minimum length of 12 and must contain all 4 types of characters (uppercase letters, lowercase letters, numbers, special characters).
* Password Expiry. When password is expired, user will be redirected to password page upon successful logon.

[[File:Faq_account005.png|800px]]

== FAQ ==

Account

2025-08-20T02:58:04Z

WFilter:

Main Page

2025-07-10T04:26:19Z

WFilter: /* Links */

{{DISPLAYTITLE:WFilter NG Firewall Documents}}
__NOTOC__

  '''WFilter NG Firewall''' is a [http://www.wfilterngf.com linux based next generation firewall and internet content filtering system].<br>
  This site provides official documents for '''WFilter NG Firewall'''. For [http://www.wfiltericf.com/WFilter.htm WFilter ICF], please check [http://wiki.wfiltericf.com Documents of WFilter ICF].<br>
  If you can not find a solution here, please [http://www.wfiltericf.com/contact.htm contact us].<br><br>

= Using WFilter NG Firewall=
* [[NewUser|Installation]]
* [[Getting Started with WFilter ROS|Getting Started]]
* [[Settings|Modules and Settings]]

= Solutions =
* [[Bandwidth_Solutions|Bandwidth Optimization solutions]]
* [[Account_Solutions|Active directory Integration]]
* [[Maccd_Solutions|By MAC address monitoring solutions]]
* [[ISP_Solutions|ISP management solutions]]
* [[WFilter_NGF_WiFi|Wifi monitoring solutions]]
* [[IPv6|IPv6]]

= Others =
* [[WFilterROS_License|License]]
* [[About_WFilterROS|About WFilter NG Firewall]]
* [[Errorcode|Errorcode]]

= Links =
* [http://www.wfilterngf.com/download.htm Downloads]
* [http://www.wfiltericf.com/protocols/getlist.php Protocols]
* [http://blog.wfilterngf.com Blog of WFilter NG Firewall]

SD-WAN

2025-07-10T04:24:26Z

WFilter: /* Cross-Platform clients */

== SD-WAN ==

SD-WAN is an integration of the ZeroTier networking. With SD-WAN, you are able to:
* Network virtualization: setup SD-WAN subnets and join multiple devices/networks together.
* End-to-End encryption
* Set up a VPN without needing a static public IP address.

== Server Settings ==

Server settings of WFilter SD-WAN can be accessed in [http://cloud.wfilterngf.com/management WFilter Cloud Service].

[[File:sdwan001.png|800px]]

=== Networks ===

Click "New network" to create a new sdwan subnet.

[[File:sdwan_network01.png|450px]]

* Net ID: SD-WAN network id
* Net Name: network description
* Start/End IP: DHCP IP address range

[[File:sdwan_network02.png|450px]]

To join multiple networks together, you need to setup routing policies. As shown below, network "192.168.1.0/24" can be reached via "10.200.188.1", while network "192.168.2.0/24" can be reached via "10.200.188.2". So these two networks are reachable from each side.

[[File:sdwan_network03.png|450px]]

== Client Settings ==

In WFilter NGF, you can join SD-WAN networks in the "VPN"->"SD-WAN" module.
* SD-WAN secret: SD-WAN client id
* Zone: zone firewall ACL rules will be applied. Please check [[firewallrule|Firewall Rules]]

[[File:sdwan_client01.png|800px]]

[[File:sdwan_client02.png|800px]]

[[File:sdwan_client03.png|800px]]

Client is denied by default, you also need to authorize clients in the server side.

[[File:sdwan_client04.png|450px]]

== Cross-Platform clients ==

WFilter's SD-WAN networks are compatible with ZeroTier clients, and you may download clients for other operating systems here: [https://www.zerotier.com/download/ zerotier download]

= Links =
* [http://blog.wfilterngf.com/?p=660 How to setup site-to-site VPN with WFilter’s SD-WAN service?]

[[Category:VPN]]

WSGCloud

2025-07-10T04:22:00Z

WFilter: /* Related Links */

{{DISPLAYTITLE:WFilter cloud service}}

= Overview =

The WFilter cloud service offers a centralized service for managing multiple wfilter devices. The following functions can be achieved:
* View device address, system version, IP address, and alert information
* Synchronize configurations
* Access the management interface via Internet

[[File:cloud_dashboard1.png|800px]]

The cloud service has following modules: Devices(management of wfilter devices), Configurations(create and synchronize configurations), and Operators(manage operators of the cloud service).

'''Please note: relaying of wfilter web UI is via our website wfilterngf.com, so the speed is not as fast as direct access.'''

= User Registration =

Click "Sign up" to create a new user. The username must be an email address, which can also be used to reset the password.

[[File:cloud_register.png|450px]]

[[File:cloud_register2.png|450px]]

In "Operators", multiple operators can be added. Operators can manage the devices and configurations under this account.

[[File:cloud_user1.png|800px]]

= Device management =
== WFilter side ==
In WFilter, the SDWAN module shall be enabled and join the cloud service network.(network ID is displayed in the upper right corner of the cloud service webpage).

[[File:cloud_clients3.png|800px]]

== Join WFilter device to the cloud service ==

In the "Devices" of the cloud service, click "New device" and enter the device's SDWAN ID, username, and password. The cloud service will retrieve information such as the status and configuration of the terminal device through WFilter API. So correct username and password shall be provided. If "Set as Template" is selected, you can also create configurations from the template in "Configurations".

[[File:cloud_clients2.png|600px]]

Click the query icon to open the web UI of wfilter device. Please note: Only one web UI can be opened at a time.

[[File:cloud_clients1.png|800px]]

= Configurations =

In "Configurations", click "New configure template" to create a configuration from a template device. As shown in the figure below:

[[File:cloud_settings1.png|800px]]

Click the "Deploy" icon to synchronize the configuration to other devices. As shown in the figure below:

[[File:cloud_settings3.png|800px]]

[[File:cloud_settings2.png|800px]]

'''Please note: synchronizing the network or firewall settings of a device may cause it to lose network connectivity. Use it with caution. You're recommended to test it locally before synchronizing to other terminals.'''

= Restricting login IPs =

If you have restricted the login IP addresses in Config - System - Operators, you need to add the cloud service's IP address (10.192.0.1) to the allowed IP list.

= Related Links =

* [http://cloud.wfilterngf.com/management WFilter Cloud Service]
* [http://cloud.imfirewall.com/management WSG Cloud Service(Chinese version)]
* [http://blog.wfilterngf.com/?p=658 Remote management via the WFilter cloud service.]

[[Category:Solutions]]

SD-WAN

2025-07-07T04:29:44Z

WFilter: /* SD-WAN */

File:Sdwan client04.png

2025-07-06T08:33:35Z

WFilter:

SD-WAN

2025-07-06T08:31:28Z

WFilter: /* Client Settings */

== SD-WAN ==

SD-WAN is an integration of the ZeroTier networking. With SD-WAN, you are able to:
* Network virtualization: setup SD-WAN subnets and join multiple devices/networks together.
* End-to-End encryption
* Setup VPN without a static public IP address.

== Server Settings ==

Server settings of WFilter SD-WAN can be accessed in [http://cloud.wfilterngf.com/management WFilter Cloud Service].

[[File:sdwan001.png|800px]]

=== Networks ===

Click "New network" to create a new sdwan subnet.

[[File:sdwan_network01.png|450px]]

* Net ID: SD-WAN network id
* Net Name: network description
* Start/End IP: DHCP IP address range

[[File:sdwan_network02.png|450px]]

To join multiple networks together, you need to setup routing policies. As shown below, network "192.168.1.0/24" can be reached via "10.200.188.1", while network "192.168.2.0/24" can be reached via "10.200.188.2". So these two networks are reachable from each side.

[[File:sdwan_network03.png|450px]]

== Client Settings ==

In WFilter NGF, you can join SD-WAN networks in the "VPN"->"SD-WAN" module.
* SD-WAN secret: SD-WAN client id
* Zone: zone firewall ACL rules will be applied. Please check [[firewallrule|Firewall Rules]]

[[File:sdwan_client01.png|800px]]

[[File:sdwan_client02.png|800px]]

[[File:sdwan_client03.png|800px]]

Client is denied by default, you also need to authorize clients in the server side.

[[File:sdwan_client04.png|450px]]

== Cross-Platform clients ==

WFilter's SD-WAN networks are compatible with ZeroTier clients, and you may download clients for other operating systems here: [https://www.zerotier.com/download/ zerotier download]

[[Category:VPN]]

File:Sdwan client03.png

2025-07-06T08:15:29Z

WFilter:

File:Sdwan client02.png

2025-07-06T08:15:07Z

WFilter:

File:Sdwan client01.png

2025-07-06T08:14:46Z

WFilter:

SD-WAN

2025-07-06T08:13:14Z

WFilter:

== SD-WAN ==

SD-WAN is an integration of the ZeroTier networking. With SD-WAN, you are able to:
* Network virtualization: setup SD-WAN subnets and join multiple devices/networks together.
* End-to-End encryption
* Setup VPN without a static public IP address.

== Server Settings ==

Server settings of WFilter SD-WAN can be accessed in [http://cloud.wfilterngf.com/management WFilter Cloud Service].

[[File:sdwan001.png|800px]]

=== Networks ===

Click "New network" to create a new sdwan subnet.

[[File:sdwan_network01.png|450px]]

* Net ID: SD-WAN network id
* Net Name: network description
* Start/End IP: DHCP IP address range

[[File:sdwan_network02.png|450px]]

To join multiple networks together, you need to setup routing policies. As shown below, network "192.168.1.0/24" can be reached via "10.200.188.1", while network "192.168.2.0/24" can be reached via "10.200.188.2". So these two networks are reachable from each side.

[[File:sdwan_network03.png|450px]]

== Client Settings ==

In WFilter NGF, you can join SD-WAN networks in the "VPN"->"SD-WAN" module.
* SD-WAN secret: SD-WAN client id
* Zone: zone firewall ACL rules are applied. Please check [[firewallrule|Firewall Rules]]

[[File:sdwan_client01.png|800px]]

[[File:sdwan_client02.png|800px]]

[[File:sdwan_client03.png|800px]]

Client is denied by default, you also need to authorize clients in the server side.

[[File:sdwan_client04.png|450px]]

== Cross-Platform clients ==

WFilter's SD-WAN networks are compatible with ZeroTier clients, and you may download clients for other operating systems here: [https://www.zerotier.com/download/ zerotier download]

[[Category:VPN]]

SD-WAN

2025-07-06T08:05:00Z

WFilter: /* Networks */

SD-WAN

2025-07-06T07:46:54Z

WFilter: /* Client Settings */

SD-WAN

2025-07-06T07:43:39Z

WFilter: /* Networks */

File:Sdwan network03.png

2025-07-06T07:39:43Z

WFilter:

File:Sdwan network02.png

2025-07-06T07:39:24Z

WFilter:

SD-WAN

2025-07-06T07:39:14Z

WFilter: /* Networks */

SD-WAN

2025-07-06T07:37:51Z

WFilter: /* Networks */

File:Sdwan network01.png

2025-07-06T07:37:27Z

WFilter:

SD-WAN

2025-07-06T07:36:09Z

WFilter: /* Networks */

SD-WAN

2025-07-06T07:22:59Z

WFilter: /* Server Settings */

File:Sdwan001.png

2025-07-06T07:19:21Z

WFilter:

SD-WAN

2025-07-06T07:19:03Z

WFilter: Created page with "== SD-WAN == SD-WAN is an integration of the ZeroTier networking. With SD-WAN, you are able to: * Network virtualization: setup SD-WAN subnets and join multiple devices/netwo..."

File:Sdwan1.png

2025-07-06T06:55:13Z

WFilter:

VPN

2025-07-06T06:55:06Z

WFilter:

{{DISPLAYTITLE:VPN}}
* [[File:pptpvpn1.png]] [[pptpvpn|PPTP / L2TP]]
* [[File:ipsecvpn1.png]] [[ipsecvpn|IPSec Tunnels]]
* [[File:openvpn1.png]] [[Openvpn|OpenVPN]]
* [[File:webvpn1.png]] [[WebVPN|WebVPN]]
* [[File:sdwan1.png]] [[SD-WAN|SD-WAN]]
* [[File:zerotier1.png]] [[ZeroTier|ZeroTier]]
* [[File:vpnclient1.png]] [[vpnclient|VPN Client]]
* [[Firewall_for_vpn|VPN related firewall settings]]

[[Category:VPN]]

WSGCloud

2025-07-06T06:51:19Z

WFilter: /* WFilter side */

{{DISPLAYTITLE:WFilter cloud service}}

= Overview =

The WFilter cloud service offers a centralized service for managing multiple wfilter devices. The following functions can be achieved:
* View device address, system version, IP address, and alert information
* Synchronize configurations
* Access the management interface via Internet

[[File:cloud_dashboard1.png|800px]]

The cloud service has following modules: Devices(management of wfilter devices), Configurations(create and synchronize configurations), and Operators(manage operators of the cloud service).

'''Please note: relaying of wfilter web UI is via our website wfilterngf.com, so the speed is not as fast as direct access.'''

= User Registration =

Click "Sign up" to create a new user. The username must be an email address, which can also be used to reset the password.

[[File:cloud_register.png|450px]]

[[File:cloud_register2.png|450px]]

In "Operators", multiple operators can be added. Operators can manage the devices and configurations under this account.

[[File:cloud_user1.png|800px]]

= Device management =
== WFilter side ==
In WFilter, the SDWAN module shall be enabled and join the cloud service network.(network ID is displayed in the upper right corner of the cloud service webpage).

[[File:cloud_clients3.png|800px]]

== Join WFilter device to the cloud service ==

In the "Devices" of the cloud service, click "New device" and enter the device's SDWAN ID, username, and password. The cloud service will retrieve information such as the status and configuration of the terminal device through WFilter API. So correct username and password shall be provided. If "Set as Template" is selected, you can also create configurations from the template in "Configurations".

[[File:cloud_clients2.png|600px]]

Click the query icon to open the web UI of wfilter device. Please note: Only one web UI can be opened at a time.

[[File:cloud_clients1.png|800px]]

= Configurations =

In "Configurations", click "New configure template" to create a configuration from a template device. As shown in the figure below:

[[File:cloud_settings1.png|800px]]

Click the "Deploy" icon to synchronize the configuration to other devices. As shown in the figure below:

[[File:cloud_settings3.png|800px]]

[[File:cloud_settings2.png|800px]]

'''Please note: synchronizing the network or firewall settings of a device may cause it to lose network connectivity. Use it with caution. You're recommended to test it locally before synchronizing to other terminals.'''

= Restricting login IPs =

If you have restricted the login IP addresses in Config - System - Operators, you need to add the cloud service's IP address (10.192.0.1) to the allowed IP list.

= Related Links =

* [http://cloud.wfilterngf.com/management WFilter Cloud Service]
* [http://cloud.imfirewall.com/management WSG Cloud Service(Chinese version)]
* [http://www.imfirewall.com/blog/post/604.html How to Perform Remote Management via the WSG Cloud Management Service?]

[[Category:Solutions]]

File:Cloud settings2.png

2025-07-04T08:48:24Z

WFilter:

File:Cloud settings3.png

2025-07-04T08:47:42Z

WFilter:

File:Cloud settings1.png

2025-07-04T08:46:39Z

WFilter:

File:Cloud clients1.png

2025-07-04T08:46:06Z

WFilter:

File:Cloud clients2.png

2025-07-04T08:44:19Z

WFilter:

File:Cloud clients3.png

2025-07-04T08:41:29Z

WFilter:

WSGCloud

2025-07-04T08:40:33Z

WFilter: /* User Registration */

{{DISPLAYTITLE:WFilter cloud service}}

= Overview =

The WFilter cloud service offers a centralized service for managing multiple wfilter devices. The following functions can be achieved:
* View device address, system version, IP address, and alert information
* Synchronize configurations
* Access the management interface via Internet

[[File:cloud_dashboard1.png|800px]]

The cloud service has following modules: Devices(management of wfilter devices), Configurations(create and synchronize configurations), and Operators(manage operators of the cloud service).

'''Please note: relaying of wfilter web UI is via our website wfilterngf.com, so the speed is not as fast as direct access.'''

= User Registration =

Click "Sign up" to create a new user. The username must be an email address, which can also be used to reset the password.

[[File:cloud_register.png|450px]]

[[File:cloud_register2.png|450px]]

In "Operators", multiple operators can be added. Operators can manage the devices and configurations under this account.

[[File:cloud_user1.png|800px]]

= Device management =
== WFilter side ==
In WFilter, the SDWAN service needs to be enabled, and the network ID displayed in the upper right corner of the cloud service should be joined.

[[File:cloud_clients3.png|800px]]

== Join WFilter device to the cloud service ==

In the "Devices" of the cloud service, click "New device" and enter the device's SDWAN ID, username, and password. The cloud service will retrieve information such as the status and configuration of the terminal device through WFilter API. So correct username and password shall be provided. If "Set as Template" is selected, you can also create configurations from the template in "Configurations".

[[File:cloud_clients2.png|600px]]

Click the query icon to open the web UI of wfilter device. Please note: Only one web UI can be opened at a time.

[[File:cloud_clients1.png|800px]]

= Configurations =

In "Configurations", click "New configure template" to create a configuration from a template device. As shown in the figure below:

[[File:cloud_settings1.png|800px]]

Click the "Deploy" icon to synchronize the configuration to other devices. As shown in the figure below:

[[File:cloud_settings3.png|800px]]

[[File:cloud_settings2.png|800px]]

'''Please note: synchronizing the network or firewall settings of a device may cause it to lose network connectivity. Use it with caution. You're recommended to test it locally before synchronizing to other terminals.'''

= Restricting login IPs =

If you have restricted the login IP addresses in Config - System - Operators, you need to add the cloud service's IP address (10.192.0.1) to the allowed IP list.

= Related Links =

* [http://cloud.wfilterngf.com/management WFilter Cloud Service]
* [http://cloud.imfirewall.com/management WSG Cloud Service(Chinese version)]
* [http://www.imfirewall.com/blog/post/604.html How to Perform Remote Management via the WSG Cloud Management Service?]

[[Category:Solutions]]

File:Cloud user1.png

2025-07-04T08:40:11Z

WFilter:

File:Cloud register2.png

2025-07-04T08:39:16Z

WFilter: