View source for Options

<span style="display:none" class="helpSource network_options">Options</span>
<span style="display:none" class="helpSource network_advanced_options">Options</span>

= Options =

Options contains some global networking options. 

* Enable SIP NAT Helper
** This enables the kernel SIP NAT fixup. Most SIP solutions handle NAT on their own, but sometimes rewriting of address inside SIP by the NAT device is necessary. Enabling this will enable bypassed SIP sessions to be rewritten in the kernel. Default is off.
* Send ICMP Redirects
** ICMP Redirects are used to alert machines if a shorter route is available. Default is on.
* Enable STP (Spanning Tree) on Bridges
** This enables STP (Spanning Tree Protocol) on bridges which is a protocol used to help detect loops and avoid packet storms in this case. Given that a bridge loop is fatal configuration, this option is off by default so the fatal configuration will fail quickly. It is NOT suggested to rely on STP to stop bridge loops.
* Strict ARP Mode
** If enabled ARP replies will only go out to for network requests where the request source matches the expected configuration. This helps avoid ARP flux with complicated networks. Strict mode means arp_ignore = 1, arp_announce = 2. Loose mode means arp_ignore = 0, arp_announce = 0. More documentation about arp_ignore and arp_announce can be found [https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt here]
* DHCP Authoritative
** If enabled, all DHCP serving is authoritative. Default is on. DHCP Authoritative is documented [http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html here].
* Block new sessions during network configuration
** If enabled, all sessions will be blocked (dropped) when network settings changes are applied. This will provide increased security for router mode deployments and is not recommended for bridged mode deployments. The default setting is disabled.
* Log bypassed sessions
** If enabled, bypassed sessions will be logged to the sessions table.
* Log outbound local sessions
** If enabled, bypassed sessions created by the NG Firewall server itself will be logged to the sessions table.
* Log inbound local sessions
** If enabled, bypassed sessions to the NG Firewall server itself will be logged to the sessions table.
* Log blocked sessions
** If enabled, all sessions blocked at layer 3 will be logged to the sessions table. This includes traffic which is malformed, damaged, or otherwise not able to be routed by NG Firewall. This option creates a large amount of logging — much of which is not diagnostically useful! — and we recommend leaving it disabled unless you are troubleshooting a specific issue. 
** This option has no effect on blocks enacted by applications; those sessions are found in the app's own Reports area.