Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Configuration Files > filter.config
filter.config
Help | Content Gateway | Version 8.0.x
Filtering rules stored in filter.config allow you to:
*
*
*
*
*
Filtering rules should be defined in the Content Gateway manager on the Configure > Security > Access Control > Filtering tab. See Creating filtering rules.
 
Important 
After you modify the file, run content_line -x from the Content Gateway bin directory (/opt/WCG/bin) to apply the changes. When you apply the changes to a node in a cluster, Content Gateway applies the changes to all nodes in the cluster.
Three filtering rules are configured by default. The first denies traffic on port 25 to all destinations. The second and third bypass user authentication for connections to 2 Websense file sandbox destinations.
Format
Each line in filter.config is a filtering rule. Content Gateway applies the rules in the order listed, starting at the top of the file. If no rule matches, the request is allowed to proceed.
Content Gateway recognizes three space-delimited tags:
primary_destination=value secondary_specifier=value action=value
The following table lists the possible primary destination types.
 
Secondary specifiers are optional. The following table lists the possible secondary specifiers and their purpose.
 
Note 
 
*
*
*
FTP (for FTP over HTTP only)
The following table lists the possible actions and their allowed values.
 
*
allow - to allow particular URL requests to bypass authentication. The proxy caches and serves the requested content.
*
deny - to deny requests for HTTP or FTP objects from specific destinations. When a request is denied, the client receives an access denied message.
*
radius - not supported.
add_hdr="header_name:header_value"
Examples
The following example configures Content Gateway to deny all FTP document requests to the IP address 112.12.12.12:
dest_ip=112.12.12.12 scheme=ftp action=deny
The following example configures Content Gateway to keep the client IP address header for URL requests that contain the regular expression politics and whose path prefix is
/viewpoint:
url_regex=politics prefix=/viewpoint keep_hdr=client_ip
The following example configures Content Gateway to strip all cookies from client requests destined for the origin server www.server1.com:
dest_host=www.server1.com strip_hdr=cookie
The following example configures Content Gateway to disallow puts to the origin server www.server2.com:
dest_host=www.server2.com method=put action=deny
Content Gateway applies the rules in the order listed in the file. For example, the following sample filter.config file configures Content Gateway to do the following:
*
*
dest_host=server1.com action=allow
dest_host=notthatsite.com action=deny

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Configuration Files > filter.config
Copyright 2016 Forcepoint LLC. All rights reserved.