Netify DPI - IP Sets Plugin

The IP Sets Plugin is a premium add-on to the Netify Agent. The software can be used to integrate with:

  • tc - traffic control and QoS
  • ip rule - multiWAN routing policies
  • iptables - firewalling and audit trails
  • any custom tools using ipsets or firewall marks

For nftables support, we recommend the Netify DPI Connection Tracking Labels Plugin.

Netify Flow Control with Plugins

How It Works

Before getting started, please take 5 minutes
to read the Network Policy Datasets document.

The Netify Agent IP Sets Plugin provides a high-speed interface to the IP Sets Linux kernel framework. Flow detections are immediately available to the plugin where flow criteria is matched against user-defined expressions. When a match occurs, managed IP Sets are updated with flow address entries (IP, Port, MAC). Various options exist to include additional metadata, such as a packet mark/mask values, QoS (tc) priority and hardware queue association.

Example Configuration

On most Linux platforms, you can find the configuration in /etc/netify.d/netify-plugin-ipset.json. The configuration below shows three network policy examples.

Applications

The first rule puts TikTok and Facebook (ID #119) traffic into the netify.social IP Set. This rule also defines an SKB mark of 0x800, so that means TikTok and Facebook traffic will automatically be marked with 0x800.

Protocols

The second rule creates an IP Set for BitTorrent traffic. By using the hash:ip rule type, the IP Set provides a list of active remote BitTorrent peers used by anyone on the local network.

Categories

The final rule creates an IP Set for all advertisers defined in Netify. In other words, it is possible to manage network policies by application categories and/or protocol categories.

{
 "version": 1,
 "default_ttl": 600,

 "ipsets": [
   {
    "name": "netify.social",
    "ttl": 3600,
    "type": "hash:ip,port,ip",
    "interface": "lan",
    "skb_mark": "0x800",
    "criteria": "(app_id == 119 || application == 'netify.tiktok');"
   },
   {
    "name": "netify.bittorrent",
    "type": "hash:ip",
    "interface": "lan",
    "criteria": "protocol == 'BitTorrent';"
   },
   {
    "name": "netify.ads",
    "type": "hash:ip,port,ip",
    "interface": "lan",
    "criteria": "app_category == 'Advertiser';"
   }
 ],

 "exemptions": [
   "192.168.242.1",
   "protocol == 'DNS';"
 ]
}

Netify Evaluation Kit

The open-source Netify Agent (netifyd) comes with 200 application and 180 protocol signatures, as well as full data stream support. Please contact us to gain access to the Netify Evaluation Kit which includes:

Integration and Custom Solutions

Do you have any questions about integration, APIs or custom development?

Contact Us