feat: update dpi documentation after refactor

docs/administrator-manual/security/content_filter.md

@@ -103,7 +103,7 @@ Considerations:
 
 - May require more processing power compared to IP or DNS-based filtering
 - Requires careful configuration to balance security and performance
-- The administrator needs to create DPI rules for each interface
+- Rules are evaluated in order and the first matching rule wins, so their position in the list matters
 
 To configure DPI filtering, see the [Deep Packet Inspection (DPI) filter](./dpi_filter.md).
 
@@ -114,7 +114,7 @@ To configure DPI filtering, see the [Deep Packet Inspection (DPI) filter](./dpi_
 | Blocking method | IP-based | DNS-based | DNS-based | Packet inspection |
 | Primary focus | Malware | Malware + basic content | Comprehensive content | Application/Protocol specific |
 | List types | Community, Enterprise | Community, Enterprise | Commercial | N/A (real-time analysis) |
-| Configuration | Firewall | Firewall | Cloud | Firewall (per interface) |
+| Configuration | Firewall | Firewall | Cloud | Firewall |
 | Reporting | None | None | Advanced, customizable | Limited |
 
 **Implementation strategies**

docs/administrator-manual/security/dpi_filter.md

@@ -11,20 +11,80 @@ The Netify Agent functions as a deep-packet inspection server, leveraging nDPI (
 
 Here\'s how it operates:
 
-- the Netify flow actions plugin assigns labels to matching connections
-- nft rules can then either block or adjust priority (DSCP) for connections based on these labels
+- the Netify Agent evaluates every flow against the DPI rules and assigns a label to the connections matching a rule
+- nft rules then block the connections labelled by a **Block** rule
 
-The administrator can create Deep Packet Inspection (DPI) rules for each interface.
+The DPI engine is always running: traffic is filtered as soon as at least one rule is enabled.
 
-## Configuration
+The **DPI filter** page is split into two tabs:
 
-To configure these rules, the administrator initiates the process by selecting the particular network interface on which the rule is intended to operate. This step ensures that the rule is precisely applied to the designated segment of the network, allowing for targeted and effective management of network traffic.
+- **Rules**: the ordered list of rules that allow or block traffic
+- **Application groups**: reusable sets of applications, protocols and categories used by the rules
 
-Following the selection of the interface, the administrator is prompted to specify the applications that are to be blocked or regulated. This essential step involves choosing from a comprehensive list of applications accessible through the system interface.
+## Application groups {#application-groups}
 
-The interface, as a default feature, presents a catalog of commonly used applications. However, it provides an advanced search functionality enabling the administrator to explore and pinpoint specific applications and application categories that require special attention.
+An application group is a named set of applications, protocols, application categories and protocol categories. Groups are created once and can be used by any number of rules.
 
-### Premium application signatures
+To create a new group, open the **Application groups** tab and click **Create application group**:
+
+- **Group name**: a unique name for the group, up to 64 characters
+- **Applications** and **Protocols** tabs: select the content of the group. Items are organized by category:
+  - selecting a category includes every item of that category, including the ones added in the future by signature updates
+  - click a category to show its contents and select individual items
+  - use the filter field and the **Show only selected** option to quickly find items
+
+The selected items are listed in the **Selected** panel, where they can also be removed. A group must contain at least one application, protocol or category.
+
+From the groups list, each group can be edited, duplicated or deleted. The **Used by rules** column shows which rules reference the group: a group used by one or more rules cannot be deleted.
+
+## Rules {#rules}
+
+DPI rules decide whether matching traffic is allowed or blocked. Rules are evaluated **from top to bottom and the first matching rule wins**: a rule never applies to traffic already matched by a rule above it. Traffic not matching any rule is allowed.
+
+This makes it possible to combine **Allow** and **Block** rules. For example, to block streaming services for the whole LAN except for a single host:
+
+1. an **Allow** rule matching all traffic from `192.168.1.10`
+2. a **Block** rule matching the streaming application group from `192.168.1.0/24`
+
+To create a new rule, open the **Rules** tab and click **Add rule**. Application groups must be created first if the rule needs to match specific applications. The rule wizard has four steps:
+
+1. **General**: the rule **Name** and its **Status** (enabled or disabled)
+2. **Source**: choose **Any source address** to apply the rule to every host, or **Enter one or more addresses** to narrow it down. Each entry can be an IP address, a CIDR network (e.g. `10.10.10.0/24`) or an IP range (e.g. `10.10.10.1-10.10.10.5`)
+3. **Match and action**:
+   - **Match type**: **Application groups** matches the traffic of the selected groups, while **All traffic** matches every flow from the source
+   - **Action**: **Block matching traffic** or **Allow matching traffic**
+   - **Rule position**: add the new rule at the **Top of the list** or at the **Bottom of the list**
+4. **Review**: check the rule settings before saving it
+
+From the rules list, each rule can be:
+
+- edited
+- enabled or disabled
+- duplicated
+- deleted
+- moved by drag and drop to change the evaluation order; reordering is available only when no filter is applied to the list
+
+The list can be filtered by name, source, match type and action.
+
+### Firewall and WAN traffic {#firewall-and-wan-traffic}
+
+DPI rules can never block the firewall itself: the IP addresses of all firewall interfaces are always exempted from the rules, so a rule can not lock the administrator out. Flows seen on the WAN interfaces are also excluded from the rules.
+
+### Custom rules {#custom-rules}
+
+Rules not created from the web interface, such as hand-written rules or rules migrated from a previous version, are marked as **Custom**. Custom rules can be enabled, disabled, moved, renamed or deleted, but their matching criteria can not be edited from the web interface.
+
+### Upgrade from previous versions {#upgrade-from-previous-versions}
+
+Previous releases configured DPI rules per network interface, with a separate list of exceptions. The configuration is converted automatically on upgrade, and also when restoring an old backup:
+
+- each rule blocking applications or protocols becomes a **Custom** **Block** rule that keeps the original behavior
+- each exception becomes an **Allow** rule placed at the top of the list, named after the exception description
+- rules with a QoS action (bulk, best effort, video, voice) and rules matching nothing are removed, as these actions are no longer supported
+
+Removed rules are logged in `/var/log/messages`. To take full advantage of the new features, consider replacing the migrated **Custom** rules with new rules based on application groups.
+
+## Premium application signatures {#premium-application-signatures}
 
 :::note
 
@@ -34,7 +94,11 @@ This feature is available only if the firewall has a valid [Community or Enterpr
 
 :::
 
-In the absence of a subscription, the system inherently recognizes a baseline of approximately 400 applications. However, with an active subscription, this capacity significantly expands, encompassing more than 2300 applications. In this scenario, the list of recognized applications undergoes daily updates, ensuring that the system stays abreast of the ever-evolving landscape of applications and digital services.
+In the absence of a subscription, the system inherently recognizes a baseline of approximately 200 applications and 300 protocols. With an active subscription, this capacity significantly expands to approximately 2500 applications, and the list of recognized applications is updated daily, ensuring that the system stays abreast of the ever-evolving landscape of applications and digital services.
+
+For more details about application and protocol licensing, see the [Netify DPI licensing page](https://www.netify.ai/products/netify-dpi/licensing).
+
+Without a subscription, the application group editor shows the full catalog, but the items not recognized by the community signatures are marked as **Available only with enterprise subscription** and can not be selected. Use the **Show only community apps** and **Show only community protocols** options to hide them.
 
 ### Applications and protocols list
 
@@ -43,15 +107,15 @@ The full list of all applications and protocols supported by the Enterprise vers
 - [Applications](https://www.netify.ai/resources/applications_reference)
 - [Protocols](https://www.netify.ai/resources/protocols)
 
-### Exceptions
-
-DPI exclusion allows for the exclusion of specific network addresses, such as the gateway or other critical infrastructure, preventing them from being blocked.
+## Logging blocked connections {#logging-blocked-connections}
 
-To add a new exception, click the `Add exception` button. Enter the `IP address or CIDR` that should be exempted from the filter. You can include a description explaining the reason for the exclusion.
+Blocked connections can be logged inside `/var/log/messages` with the `DPI block: ` prefix. To enable logging:
 
-Each exception can be enabled or disabled as desired.
+    uci set dpi.config.log_blocked=1
+    uci commit dpi
+    /etc/init.d/dpi reload
 
-### Netify traffic bypass
+## Netify traffic bypass
 
 By default, Netifyd processes all traffic passing from, to, and out of the firewall. In some cases it may be desirable to completely ignore traffic analysis for specific hosts or subnets. Bypasses are configured using the `bypassv4` and `bypassv6` options, which take a list of IP addresses or CIDR subnets. A description can be added after a `|` pipe character.
 

docs/administrator-manual/system/subscription.md

@@ -18,7 +18,7 @@ sidebar_position: 1
 Typical benefits of the subscription service include:
 
 - **Monitoring portals**: subscribers can access monitoring portals to manage their subscription and receive [alerts](../monitoring/monitoring.md#alert-section) for registered servers.
-- **Enhanced DPI signatures**: firewalls with a valid subscription have access to a much larger database of [DPI signatures](../security/dpi_filter.md) (more than 1820 in total instead of 415) that are regularly updated.
+- **Enhanced DPI signatures**: firewalls with a valid subscription have access to a much larger database of [DPI signatures](../security/dpi_filter.md) (approximately 2800 applications/protocols instead of 500) that are regularly updated.
 - **Enterprise Block lists**: Firewalls with a valid subscription can purchase high-quality IP and DNS blocklists. These lists are actively maintained, updated very frequently, and exhibit high effectiveness while generating a very low number of false positives, they can be used in [IP](../security/threat_shield_ip.md) and [DNS](../security/threat_shield_dns.md) block lists.
 - **Automatic remote backup**: subscribers can benefit from automatic remote backups of the firewall configuration. This feature is crucial for businesses that need to ensure the safety of their data and configurations.
 - **Support**: subscribers can receive priority support on stable releases. This can be crucial for businesses relying on NethSecurity for their operations. See also [Remote support](./remote_support.md).

i18n/it/docusaurus-plugin-content-docs/current/administrator-manual/security/content_filter.md

@@ -103,7 +103,7 @@ Considerazioni:
 
 - Potrebbe richiedere più potenza di elaborazione rispetto al filtraggio basato su IP o DNS
 - Richiede una configurazione attenta per bilanciare sicurezza e prestazioni
-- L'amministratore deve creare regole DPI per ogni interfaccia
+- Le regole vengono valutate in ordine e prevale la prima regola corrispondente, quindi la loro posizione nell'elenco è importante
 
 Per configurare il filtraggio DPI, vedere [Filtro Deep Packet Inspection (DPI)](./dpi_filter.md).
 
@@ -114,7 +114,7 @@ Per configurare il filtraggio DPI, vedere [Filtro Deep Packet Inspection (DPI)](
 | Metodo di blocco | Basato su IP | Basato su DNS | Basato su DNS | Ispezione dei pacchetti |
 | Enfasi principale | Malware | Malware + contenuti di base | Contenuti completi | Specifico per applicazione/protocollo |
 | Tipi di liste | Comunità, Aziendali | Comunità, Aziendali | Commerciale | N/A (analisi in tempo reale) |
-| Configurazione | Firewall | Firewall | Cloud | Firewall (per interfaccia) |
+| Configurazione | Firewall | Firewall | Cloud | Firewall |
 | Reporting | Nessuno | Nessuno | Avanzato, personalizzabile | Limitato |
 
 **Strategie di implementazione**