Firewall Rules
Firewall rules let Flowtriq automatically run commands on a node the moment an attack is detected - without waiting for a human to respond. Rules are evaluated in real time as each incident opens.
Scope: Firewall rules run commands on the monitored server via the agent (e.g.
iptables rules). For large volumetric floods that saturate your link, use Cloud Scrubbing integrations to auto-divert traffic to upstream providers like Cloudflare Magic Transit, OVH, or Hetzner.Configuring Rules
Go to Dashboard → Firewall Rules to create and manage rules. Each rule has:
- Trigger - what incident property fires the rule: attack family, severity level, PPS threshold, or any incident.
- Action - what the agent runs: a shell command (e.g.
iptables -A INPUT -p udp -j DROP), a script path, or a webhook call. - Target nodes - apply to all nodes or specific nodes only.
- Cooldown - minimum minutes between rule executions per node, to avoid repeated firing.
Example: Block UDP floods automatically
# Rule configuration
Name: Block UDP on attack
Trigger: Attack family = udp_flood
Action: iptables -A INPUT -p udp -j DROP
Nodes: All
Cooldown: 10 minutes
When the agent detects a UDP flood incident, it immediately runs the command, logs the result, and records the action in the audit log.
Supported Trigger Types
| Trigger | Description | Example value |
|---|---|---|
| attack_family | Matches incident attack classification | udp_flood, syn_flood, dns_flood |
| severity | Minimum severity level | critical, high, medium, low |
| pps_threshold | Peak PPS exceeds value | 100000 |
| any | Fires on every new incident |
Supported Actions
| Action type | Description |
|---|---|
| shell_command | Runs a shell command on the node as root via the agent |
| script | Executes an absolute path script on the node |
| webhook | POSTs incident JSON to a URL (external integration) |
| null_route | Adds a local null route for the top source IPs from the PCAP |
Safety & Audit
- All executions are logged in the Audit Log with rule name, node, trigger, and result.
- Rules respect the cooldown period - a node won't fire the same rule twice within the cooldown window.
- Rules can be toggled active/inactive without deletion.
- Only admin and owner roles can create or delete rules. Analysts can view.
Tip: Combine firewall rules with alert channels - the rule handles the immediate response while your team gets notified through PagerDuty, Slack, or SMS to handle the longer-term mitigation with your upstream provider.