OpenWrt Reference

Though Netify is able to run on any flavor of Linux and xBSD, this document provides hands-on details on a working proof-of-concept with Netify and OpenWrt. We will walk through some of the concepts and provide some examples showcasing DPI/Layer 7 features:

• Shaping the BitTorrent protocol with QoS
• Implementing a MultiWAN routing policy for stream media applications
• Blocking Facebook traffic using DPI metadata
• Enabling Netify network intelligence

Netify and FWA

This working proof-of-concept uses two separate daemons (see adjacent table) to accomplish the target features listed above.

To install and configure netifyd on OpenWrt 21.02, run:

opkg update
opkg install netifyd

Now it’s time to configure example rules for demonstrating the three different rule types in Netify FWA. Keep in mind, the vanilla software can be customized to take any kind of action and enforce any kind of network policies, these are just the default types available in the vanilla install.

The Netify FWA rules are configured in the /etc/netify-fwa/netify-fwa.json file. The adjacent rules are used in the examples provided later in this document:

Example: /etc/netify-fwa/netify-fwa.json

{
  "version": "1.0",
  "rules": [
    {
        "type": "ipset",
        "application_category": "streaming-media"
    },
    {
        "type": "mark",
        "protocol": "bittorrent",
        "mark": 3
    },
    {
        "type": "block",
        "application": "netify.facebook"
    }
  ]
}

The example configuration file specified a block rule for Facebook traffic (see adjacent). If you use the ipset command line tool, you should see two Facebook-related IP set lists (NFA4_APP_FACEBOOK and NFA6_APP_FACEBOOK) when netify-fwa is running - one for IPv4 and the other for IPv6.

You can use a web browser or a mobile app to test Facebook DPI blocking. You will see IP/port information similar to the adjacent example when traffic is flowing through the OpenWrt system. You may also see some Facebook traffic pass through before getting blocked. There are some tricks to speed up the reaction time - please feel free to contact us for details!

# Configuration block from /etc/netify-fwa/netify-fwa.json
{
  "type": "block",
  "application": "netify.facebook"
}

# ipset list
...
Name: NFA4_APP_FACEBOOK
Type: hash:ip,port,ip
Revision: 5
Header: family inet hashsize 1024 maxelem 65536 timeout 1200
Size in memory: 352
References: 2
Number of entries: 2
Members:
45.57.90.1,tcp:443,192.168.1.169 timeout 1195
54.160.93.182,tcp:443,192.168.1.169 timeout 1195

...
Name: NFA6_APP_FACEBOOK
Type: hash:ip,port,ip
...

First, the streaming media application category is configured in the Netify FWA configuration file (/etc/netify-fwa/netify-fwa.json) as shown in the adjacent configuration block.

Next, you can use the mwan3 web-based interface to configure a rule to send all applications in Netify’s media streaming category (Netflix, YouTube, Hulu, etc.) out the second WAN interface (wanb_only). The adjacent configuration block from /etc/config/mwan3 is what it looks like under the hood.

In order to be compatible with OpenWrt's mwan, the IP set will only contain a list of server IP addresses instead of the full 3-part identifier: Client IP - Server IP - Server Port. This behavior can be customized and modified in the OpenWrt driver for Netify FWA.

# Configuration block from /etc/netify-fwa/netify-fwa.json
{
  "type": "ipset",
  "application_category": "streaming-media"
}

# Configuration block from /etc/config/mwan3

config rule ‘media_streaming’
    option proto 'all'
    option sticky '1'
    option timeout '300'
    option ipset 'NFA4_APPCAT_STREAMING_MEDIA'
    option use_policy 'wanb_only'

The last example is a plug for our own solution - Netify Informatics! There's a 7-day free trial, so go ahead and give it a try. To enable the service:

netifyd --enable-sink
service netifyd restart
netifyd -p

The last command provides the Agent UUID - you will need that ID to provision the system here. You can read about the Features and Benefits on this web site.

Netify Informatics automatically identifies and inventories devices on the network