Refactor DPI UI for a more effective filtering: firewall-like rules, reusable profiles, categories management

Description

The current DPI UI only allows rules to be applied per interface with no categories support. This exposes a small part of what the filter is actually able to do, and limits its adoption.

Expected Behavior

Profiles group applications and protocols, and can be reused across rules.
Rules apply profiles and behave like firewall rules.
Category management is available.

Additional notes
Related design issue
#1667

QA

Image: image

1. Upgrade and migration

Migration of rules and exceptions on upgrade

On a NethSecurity 8.8.0, create one or more DPI rules (some enabled, some disabled) and one or more exceptions.
Upgrade NethSecurity with the QA image or with the specific package.
Open the DPI page.

Expected:

The old rules are block rules marked "Custom": they are not managed by the UI, so they can only be renamed, enabled/disabled, deleted and moved to change their priority.
In the table, Custom rules show the whole criteria of the old DPI rule.
The exceptions are allow rules managed by the UI, placed at the top of the list, and can be edited.
Enabled and disabled state of rules and exceptions is preserved.
The same traffic blocked before the upgrade is still blocked, and the hosts that were in the exceptions are still not blocked.

Migration is not repeated

After the first test case, reboot the firewall.
Open the DPI page.

Expected: rules, order and names are unchanged, and there are no duplicated rules.

Restore of a backup taken on 8.8.0

Take a backup on a NethSecurity 8.8.0 with DPI rules and exceptions.
Restore it on a unit running the QA image.

Expected: the result is the same as the previous test cases.

2. Application groups

Create a group

Go to DPI → Application groups and create a group with some applications and some protocols.

Expected: the group is listed with a summary of its content (e.g. "2 applications · 1 protocol") and the "Not used" badge.

Select a whole category

Create or edit a group and select a whole category (e.g. Games).
Unselect one application of that category, then select it again.

Expected:

The category shows "All selected", and the group summary counts it as a category, not as single applications.
Unselecting one application leaves the rest of the category selected as single items. Selecting it again turns the selection back into the whole category.
The "uncategorized" bucket (last in the list) cannot be selected as a whole, only its single items.

Filters in the group modal

In the group modal, search by name, use "Show only selected", and, without a subscription, "Show only community".
Switch between the Applications and Protocols tabs, then clear the filters.

Expected: only matching categories and items are shown. When nothing matches, an empty state with a button to clear the filters is shown. Switching tab clears the search.

Group validation

Try to save a group:

with no content selected;
with an empty name;
with a name longer than 64 characters;
with the same name as an existing group (also with different upper/lower case).

Expected: each case shows a clear error and the group is not saved.

Edit and duplicate a group

Edit a group: change its name and content.
Duplicate a group.

Expected: changes are saved. The duplicate opens prefilled with the same content and is saved as a new group. If the edited group is used by a rule, the rule applies the new content.

Delete a group

Delete a group that is not used by any rule.
Open the menu of a group used by a rule.

Expected: the unused group is deleted. A group used by a rule cannot be deleted (the Delete option is not shown), and the "Used by rules" column lists the rules that use it.

Group list

Create more than 10 groups.
Change page and page size, then search by name.

Expected: groups are sorted by name, pagination works and searching brings you back to the first page.

3. Rules

Create a block rule for every host

With no rules configured, check the empty state, then create a rule with source "Any", a group containing an application (e.g. YouTube) and action Block.

Expected: the wizard review shows the right data, the rule is listed, and the application is blocked for every LAN client.

Block rule with a source

Create a Block rule with a group and, as source, the IP of one client. Also try a CIDR network, an IP range and an IPv6 address.

Expected: only the listed hosts are blocked; the other clients can reach the application. Invalid sources (e.g. text, a reversed range) are rejected by the wizard.

Allow rule above a Block rule

Create a Block rule for everyone on a group.
Create, at the top of the list, an Allow rule with match "All traffic" for one client.
Move the Allow rule below the Block rule.

Expected: while the Allow rule is above, that client is not blocked and the others are. When it is moved below, that client is blocked too (the first matching rule wins).

Rule matching all traffic

Create a Block rule with match "All traffic" and a single client as source.

Expected: all traffic of that client is blocked once classified by DPI, the other clients are not affected. In the wizard, groups cannot be selected when "All traffic" is chosen.

Rule position on creation

With some rules already present, create a new rule with position "Top", then another with position "Bottom".

Expected: the rules are placed at the top and at the bottom of the list.

Edit a rule

Edit a rule managed by the UI: change name, source, groups and action.

Expected: the changes are saved and applied to the traffic, and the rule keeps its position in the list.

Duplicate a rule

Duplicate a rule managed by the UI.

Expected: the wizard opens prefilled with the same data and a duplicated name, and the new rule is added to the list. Duplicate is not offered for Custom rules.

Enable and disable a rule

Disable a rule, then enable it again. Repeat with a Custom rule.

Expected: the disabled rule is shown as disabled and its traffic is no longer blocked; once enabled again it is blocked again.

Delete a rule

Delete a rule.

Expected: a confirmation is requested, the rule is removed and the order of the others is kept.

Reorder rules

Drag a rule to a different position, including the top and the bottom of the list.

Expected: the new order is saved and applied.

Rule filters

Filter the rules by name, source, group and action, then reset the filters.

Expected: only matching rules are shown. While a filter is active, drag & drop is disabled and a tooltip explains why. When nothing matches, an empty state is shown.

Rule table

Create a rule with more than 3 sources, a rule with several groups and a rule matching all traffic.

Expected: extra sources are collapsed into "+N others" with a tooltip, groups show their content in a tooltip, and the action is shown with its icon (Allow / Block), dimmed when the rule is disabled.

Group used in a rule

Add an application to a group already used by an enabled Block rule.

Expected: the new application is blocked without editing the rule.

4. Subscription

Without subscription

On an unregistered unit, open DPI → Application groups and create a group.

Expected: the "Limited catalog" banner is shown. Premium applications cannot be selected, and the "Show only community" filter is available.

Dismissing the banner

Close the "Limited catalog" banner, reload the page, then log in with another user.

Expected: the banner stays closed for the user who closed it, and is shown again for the other user.

Registration

Register the unit with a valid subscription.
Open the group modal again.

Expected: premium applications can be selected, the banner and the community filter are gone, with no need to log out.

Unregistration with premium applications in a group

With a group containing premium applications, unregister the unit.
Edit and save the group.

Expected: the premium applications are still in the group, shown as not editable, the group can still be saved, and the DPI service keeps working.

Overall I think it could be verified but I'm going to add some minor notes. We need to decide if something should be fixed.

Migrated rules are a bit "ugly" and may be a little bit overwhelming for users:
"Duplicate" opens a drawer titled "Edit rule": Rules → menu of a rule → Duplicate: the drawer says "Edit rule". Saving correctly creates a new copy and leaves the original rule unchanged, so only the title is wrong. I think this one worth fixing
The wizard talks about a log option that does not exist: add rule → step 3 "Match and action". The text under the heading says: "Choose the traffic to match, then decide whether to allow or block it and whether to log it". There is no log option in this step. IMO it worth fixing it

Minor findings:

an invalid/broken custom rule turns off all DPI filtering, I think it's by design but maybe worth adding it to readme
after restoring a backup taken on 8.8.0, /etc/config/dpi still has option enabled and option firewall_exemption. The upgrade removes them, but a restore does not.

New testing image: image

2 and 3 fixed, verified

Refactor DPI UI for a more effective filtering: firewall-like rules, reusable profiles, categories management #1896

Description

Activity

m-dilorenzi commented on Oct 9, 2026

QA