Object Reference Guide
TOORCE Firewall uses reusable objects and profiles that you create once and reference across multiple policies. This page explains each object type, where it is used, and the recommended order for configuration.
Configuration order (recommended)
Configure objects in this order before creating firewall rules:
1. Network Settings → Interfaces
2. Aliases & Objects → Address, Ports
3. Security Profiles → Time, GeoIP, AV, Web, App, IPS
4. DNS Security → DNSSEC, filtering, threat intel, logging
5. Auth & Users → Local Users/Groups (if needed)
6. Rules & Policies → Inline Rules
7. VPN Tunnels (if needed)
8. SDWAN → Multi-WAN (if needed)
Object types and references
Address Objects
Location: Aliases & Objects → Address
| Field | Description | Example |
|---|---|---|
| Name | Unique object name | LAN_Subnet |
| Address Type | Host, Network, Range, List | Network |
| Value / Start / Network | IP, CIDR, or range start | 192.168.100.0 |
| End / Netmask | Range end or netmask | 255.255.255.0 |
Used in:
| Consumer | Field name |
|---|---|
| Inline Rules | Source Address Objects, Destination Address Objects |
| DNAT Rules | Source/Destination Address Start/End |
| VPN policies | Local/remote network selectors |
Port Objects
Location: Aliases & Objects → Ports
| Field | Description | Example |
|---|---|---|
| Name | Unique service name | HTTPS |
| Protocol / Type | TCP, UDP, ICMP, or list | TCP |
| Port / Start / List | Single port or range start | 443 |
| End Port | Range end (optional) | — |
Used in:
| Consumer | Field name |
|---|---|
| Inline Rules | Source Service/Port Objects, Destination Service/Port Objects |
| DNAT Rules | Source/Destination Port Start/End |
Time Profiles (Schedules)
Location: Security Profiles → Time Profiles
| Field | Description | Example |
|---|---|---|
| Profile Name | Schedule name | Business_Hours |
| Weekly Schedule | Day/time matrix | Mon–Fri 08:00–18:00 |
Used in:
| Consumer | Field name |
|---|---|
| Inline Rules | Time Profile |
| Web Security profiles | Time profile |
| Application Security profiles | Time profile |
| IPS Security profiles | Time profile |
Before deleting a schedule in use, reassign the rule to a different schedule or delete the rule first.
GeoIP Profiles
Location: Security Profiles → Geoip Security
Used in:
| Consumer | Field name |
|---|---|
| Inline Rules | Source GeoIP profile, Destination GeoIP profile |
Security Profiles
| Profile type | Location | Used in Inline Rules as |
|---|---|---|
| Antivirus | Security Profiles → Antivirus Security | Antivirus Profile |
| Web Security | Security Profiles → Web Security | Web Filter / URL categories |
| Applications | Security Profiles → Applications Security | Application Control |
| IPS | Security Profiles → IPS Security | IPS Profile |
| AV Custom Signatures | Security Profiles → AV Custom Signatures | Custom AV rules (Redis) |
Network Interfaces
Location: Network Settings → Interfaces
| Field | Description | Example |
|---|---|---|
| Interface Name | System interface | enp6s0 |
| Alias | Friendly name | LAN |
| IP Address/CIDR | Interface IP | 192.168.100.1/24 |
| Zone | Security zone | LAN |
| DHCP Mode | Server / Relay / Off | Server |
| DHCP Start/End IP | DHCP pool | 192.168.100.100 – 192.168.100.200 |
| Admin Access | HTTP/HTTPS/SSH on interface | HTTPS enabled |
Used in:
| Consumer | Field name |
|---|---|
| Inline Rules | Source Interface, Destination Interface |
| Static Routes | Interface (dev) |
| SDWAN Multi-WAN | Interface Name |
| VPN tunnels | Local/remote interface binding |
Local Users / Groups
Location: Auth & Users → Local Users/Groups
Used in:
| Consumer | Field name |
|---|---|
| Inline Rules | Source Users |
| ZTA/SSL VPN | Allowed Users, Groups |
| SSO authentication | User directory |
Access Profiles
Location: User Management → Access profiles
Used in:
| Consumer | Field name |
|---|---|
| Administrators | Access profile (controls admin panel permissions) |
DNS Security
Location: DNS Security
TOORCE sits in front of the local DNS server (AD DNS / BIND) or intercepts DNS on the wire. Client queries are validated, categorized, and logged before they reach recursive resolution.
| Capability | What it does |
|---|---|
| DNSSEC Validation | Validates RRSIG, DNSKEY, and DS; automatic root trust-anchor / KSK rollover |
| Threat Intelligence | Blocks malware, phishing, C2, botnet, ransomware, and newly observed domains |
| DNS Filtering | Category blocks (malware, gambling, adult, newly registered, dynamic DNS) |
| Reputation cache | Redis-backed domain reputation used across DNS lookups |
| Anti-Tunneling / Anti-DGA | Detects encoded subdomains, TXT abuse, and algorithmically generated names |
| Anomaly Protection | Rate limiting, amplification, malformed DNS, NXDOMAIN floods |
| DoH/DoT Control | Detects and blocks encrypted DNS that bypasses TOORCE policy |
Used in:
| Consumer | Field name |
|---|---|
| DHCP / client resolver | Clients should use TOORCE as DNS (or be intercepted) |
| Inline Rules | DNS (UDP/TCP 53), DoT (TCP 853), DoH (HTTPS) |
| Logs & Events → DNS Security Logs | Query, category, reputation, DNSSEC status, action |
SDWAN Profile
Location: SDWAN → Multi-WAN
| Field | Description | Example |
|---|---|---|
| Interface Name | WAN interface | enp9s0 |
| Gateway | Next-hop (empty for PPPoE) | 192.168.1.1 |
| Weight | Load-balance weight | 50 |
| Priority | Failover priority (1 = highest) | 1 |
| Enabled | Active link | ✓ |
Used in:
| Consumer | Field name |
|---|---|
| Inline Rules | SDWAN Profile |
| M-WAN Logs | Link health monitoring |
Inline Rule — full field reference
Location: Rules & Policies → Inline Rules
| Field | Type | References object |
|---|---|---|
| Rule Name | Text | — |
| Enabled | Checkbox | — |
| Rule Type | Select | Firewall / NAT / etc. |
| Source Interface | Multi-select | Network Interfaces |
| Destination Interface | Multi-select | Network Interfaces |
| Source Address Objects | Multi-select | Address Objects |
| Destination Address Objects | Multi-select | Address Objects |
| Source Service/Port Objects | Multi-select | Port Objects |
| Destination Service/Port Objects | Multi-select | Port Objects |
| Source Users | Multi-select | Local Users/Groups |
| Source GeoIP profile | Select | GeoIP Profiles |
| Destination GeoIP profile | Select | GeoIP Profiles |
| Time Profile | Select | Time Profiles |
| IPS Profile | Select | IPS Security Profiles |
| Antivirus Profile | Select | Antivirus Profiles |
| Application Control | Select | Application Profiles |
| SDWAN Profile | Select | SDWAN Profiles |
| Action | Select | Allow / Deny / etc. |
| Log profile | Select | Logging settings |
| DNAT Policy | Select | DNAT Rules (if NAT) |
Quick reference diagram
Interfaces ──────┐
Address Objects ─┼──► Inline Rules ──► Firewall Logs
Port Objects ────┤ │
Time Profiles ───┤ ├──► IPS Logs
GeoIP Profiles ──┤ ├──► Web Logs
AV/Web/App/IPS ──┘ └──► Application Logs
DNS Security ──────────────► DNS Security Logs
Local Users ───────────────► Inline Rules / VPN
Access Profiles ───────────► Administrators
SDWAN Profile ─────────────► Inline Rules / M-WAN Logs
Certificates ──────────────► Proxy / IPSec / SSL VPN