# Configuring a Zone Filter (AntiDDoS)

This section describes how to configure a filter, which is used by the cleaning device to perform static filtering over the traffic destined for the Zone.

#### Filter Category

The AntiDDoS provides IP, TCP, UDP, HTTP, DNS, ICMP, and SIP filters. For details, see Table 1.

The IP filter can process all types of IP packets whereas other filters can only process the packets of their own types. For example, the HTTP filter can process only HTTP packets.

You can configure a maximum of 512 filters on one anti-DDoS device.

Table 1 Seven filters
Protocol | Filtering Condition
--- | ---
IP protocol | Source IP address, destination IP address, packet length, TTL, fingerprint, protocol, DSCP, and fragment type
TCP protocol | Source IP address, destination IP address, packet length, TTL, fingerprint, DSCP, fragment type, TCP flag bit, source port, and destination port
UDP protocol | Source IP address, destination IP address, packet length, TTL, fingerprint, DSCP, fragment type, source port, and destination port
ICMP protocol | Source IP address, destination IP address, packet length, TTL, fingerprint, DSCP, and fragment type
HTTP protocol | Source IP address, destination IP address, packet length, TTL, fingerprint, DSCP, fragment type, TCP flag bit, source port, HTTP field (including opcode, cookie, host, user-agent, and referer), and URI
DNS protocol | Source IP address, destination IP address, packet length, TTL, fingerprint, DSCP, fragment type, source port, DNS QR (query and reply), and DNS field (including the domain and type)
SIP protocol | Source IP address, destination IP address, packet length, TTL, fingerprint, DSCP, fragment type, source port, caller and callee

#### Filter Template

The ATIC management center provides 24 common filter templates. You can use any of them as required.

DNS_Amplification | DNS amplification attack
Chargen_Amplification | Chargen amplification attack
SNMP_Amplification | SNMP amplification attack
TFTP_Amplification | TFTP amplification attack
NTP_Amplification | NTP amplification attack
NetBIOS_Amplification | NetBIOS amplification attack
SSDP_Amplification_Attack | SSDP amplification attack
QOTD_Amplification | QOTD amplification attack
Quake_Network_Protocol | Quake amplification attack
Steam_Protocol_Amplification | Stream amplification attack
Portmapper_Amplification | Portmapper amplification attack
Wordpress_Amplification | Wordpress amplification attack
Microsoft_SQL_Resolution_Service_Amplification | SQL amplification attack
RIPV1_Amplification_Attack | RIPV1 amplification attack
Sentinel_Amplification_Attack | Sentinel amplification attack
LDAP_Amplification_Attack | LDAP amplification attack
QUIC | QUIC amplification attack
mDNS_Amplification | mDNS amplification attack
Memcached_Amplification | Memcached amplification attack
IPMI_Amplification_Attack | IPMI amplification attack
Mutant_SSDP_Amplification_Attack | Mutant_SSD amplification attack
ONVIF_Amplification_Attack | ONVIF amplification attack
ARMS_Amplification_Attack | ARMS amplification attack
OpenVPN_Amplification_Attack | OpenVPN amplification attack

You can edit or delete templates as required.

#### Filter Matching Sequence

Packets match filters in the list from top to bottom. The matching stops only after the packets match any action defined in the filter.

#### Operation

Choose Defense > Policy Settings > Filter > Zone Filter and configure the filter.

Operation | Description
--- | ---
Create | Click to create a filter. For details, see Creating a Filter.
Modify | Click in the Operation column and modify the filter in the Modify Filter dialog box.
Delete | Select the check box for the filter and click .
Search | Enter part of a filter name or the full name in Name and click .

- Creating a Filter
  Seven types of filters are available for static filtering based on the user-defined keyword and action for matched packets. When creating a filter, you can directly bind a Zone to the filter.
- Associating a Zone with a Filter
  You can use either of the following methods to associate a Zone with a filter.

Parent topic: Zone Filter

Copyright © Huawei Technologies Co., Ltd.