Firewall objects are groups of addresses, networks or other criteria. A rule uses them as sources (Inbound object tab) or destinations (Outbound object tab).
Update an object, and every rule that uses it follows.
¶ The objects list
Your Firewall › Firewall objects lists the objects available to the firewall rules.
¶ Create an object
Click New object, give it a name and choose its type, then add its items:
| Type | Items |
|---|---|
| Source or destination addresses | IP addresses and networks (192.168.10.0/24). |
| MAC addresses | Network cards of the local network. |
| Countries (GeoIP) | Countries, matched against the GeoIP database. See Deny access from specific countries and Filter by geographic location. |
| Dynamic DNS | The records of a DNS zone, refreshed regularly. See Dynamic DNS object. |
| Local networks | The networks of the appliance interfaces. |
¶ How objects are applied
- Each object becomes a kernel address set (ipset): a rule with one object of 100 000 networks is still one fast rule.
- When a rule has several source and destination objects, Artica creates one kernel line per combination.
- An object that cannot be built (for example a GeoIP object larger than the set limit) makes Artica skip the rule and report it, instead of applying the rule without its match — a rule without its source would apply to all the traffic.
Objects are shared with other Artica features (proxy ACLs): the import, backups and Delete all buttons act on the whole list.