Internal Networks

Overview

The Internal Networks page defines the IPv4 and IPv6 address ranges that belong to your organization, which are the networks DeDDoS protects. Other components use these ranges to tell your own addresses apart from outside addresses.

Use this page to:

• Register your organization’s subnets, such as offices, data centers, VPN pools, and cloud networks.
• Add new ranges when your infrastructure grows.
• Correct a label or adjust a range after a network change.
• Remove ranges that are no longer yours.

The ranges are used in these places:

1. DSS detection engine – DSS uses the ranges to decide which side of the observed traffic is your network. It downloads the list from the web platform when it starts. Only IPv4 entries are currently sent to DSS. See How Changes Take Effect.
2. Dashboard charts – When a Statistics chart groups data by alert IP address, addresses inside an internal network are not geolocated, so no country is shown for them.
3. External API – Other components can read the list from the web platform’s API.

How to Open This Page

1. Click Administration in the top navigation bar.
2. Click the Internal Networks tab (network-diagram icon) in the strip of administration sections.

The page address is /administration/internal_networks.

You need the Modify Settings or the View Settings permission to open this page. With View Settings only, the list is read-only: the Add button and the per-row edit and delete buttons are hidden. If you do not see the tab, ask an administrator to check your group permissions. See Administration for details.

Main Areas

The page has a toolbar at the top and the network list below it.

Click to enlarge

• 1 Administration section tabs – switch between administration sections. The active tab (Internal Networks) is highlighted.
• 2 Add button – opens the form for a new internal network.
• 3 Total item count – for example, “Total: 4 items”. While a search is active it shows the number of matching networks.
• 4 Search field and search button – filter by name or value.
• 5 Page-size selector – choose 10, 25, 50, or 100 networks per page.
• 6 Network list – Name, Value, and Actions columns. Each name starts with a row help tip (question-mark icon).

Toolbar

• Add – Opens the Add Internal Network form. Hidden for read-only users.
• Total: N items – The number of networks, or the number of matches while a search is active.
• Search field – Placeholder “Search by name or value…”. See Searching.
• Page-size selector – 10 (default), 25, 50, or 100 networks per page. Changing it returns you to page 1.
• Pagination – Page buttons appear at the right end of the toolbar when the list does not fit on one page. The current page is highlighted, and the left and right arrows go to the previous or next page. Up to five page numbers are shown, with an ellipsis (…) for skipped pages.

Network List

Networks are listed in the order they were created.

Row Help Tip

Each row starts with a question-mark icon. Hover over it, or move keyboard focus to it, to show a short summary of the row.

Click to enlarge

For example: Protected network “Customer VPN address pool” – trusted address range (203.0.113.64-203.0.113.95) that detections ignore. Use the pencil to edit or the trash to remove it.

Protected Entry – “Administrators”

If a network is named exactly Administrators, its edit and delete buttons are hidden, so it cannot be changed or removed on this page.

Empty States

• When no internal networks exist, a blue information banner reads No internal networks defined. Click Add to create the first one.
• When a search matches nothing, a yellow banner reads No results found for “<your search term>”.

Adding a Network

1. Click Add in the toolbar. The Add Internal Network dialog opens.

   Click to enlarge

2. Fill in the Name and Value fields. See Form Fields.

3. Click Save. On success, a “The internal network has been successfully added!” notification appears, the dialog closes, and the list reloads.

4. To cancel, click Close or the X in the top-right corner.

Editing a Network

1. Click the Edit button (pencil icon) on the network’s row. The Edit Internal Network dialog opens with the current values filled in.

   Click to enlarge

2. Change the Name, the Value, or both.

3. Click Save. On success, a “The internal network has been successfully updated!” notification appears and the list reloads.

Deleting a Network

1. Click the Delete button (trash-can icon) on the network’s row.

2. A confirmation dialog names the network and its range, for example Delete internal network “Customer VPN address pool” (203.0.113.64-203.0.113.95)?, followed by “This action cannot be undone.”

   Click to enlarge

3. Click Yes, continue to delete, or Cancel to keep the network. Cancel has keyboard focus when the dialog opens.

4. A “The internal network has been successfully deleted!” notification appears and the list reloads.

Warning: After you delete a range, those addresses are treated as outside addresses. For example, dashboard charts look up their location again, and (for IPv4 entries) DSS no longer treats them as yours once it restarts.

Form Fields

The add and edit forms have the same two fields. They are checked when you click Save.

Accepted Value Formats

• IPv6 entries are used by the web dashboard only, for now. DSS itself can now match IPv6 entries against IPv6 traffic, but the web platform still sends only IPv4 entries (CIDR ranges, IP ranges and single addresses) to DSS. This is kept until every DSS deployment runs a version with the updated parser. IPv6 entries are stored and listed normally and are applied to dashboard charts, but today they have no effect on DSS detection.
• All IPv4 formats work in DSS. DSS reads single addresses, CIDR ranges and from-to ranges correctly, so an IPv4 from-to range now takes effect in detection too. Ranges are no longer expanded into individual addresses, so very large ranges (for example /8) are not a memory concern.
• Overlapping ranges are not checked. Keep ranges distinct to avoid confusion.

Validation Errors

Click to enlarge

For example, adding 198.51.100.128/25 a second time shows 198.51.100.128/25 is already an internal network under the Value field, and the dialog stays open:

Click to enlarge

If the network cannot be saved for a reason that is not tied to a field (for example, a database error), the message appears in a red box at the top of the dialog, above the fields. The dialog stays open so you can try again or click Close.

Searching

Click to enlarge

• Type in the search field (placeholder “Search by name or value…”). The list filters as you type and shows networks whose Name or Value contains the text, regardless of upper or lower case. Pressing Enter or clicking the magnifying-glass button has no further effect.
• The counter shows the number of matching networks.
• Click the X button next to the search field to clear the search and show all networks again.

Search and pagination run in your browser on the full list, which is loaded when the page opens.

How Changes Take Effect

• Web dashboard – Changes apply the next time a chart is loaded.
• DSS – DSS reads the internal networks from the web platform once, when it starts (through the web platform’s /api/postGetCIDRExternal endpoint). Restart the DSS service after adding, changing, or removing a range for the change to reach detection. DSS parses single IPv4 and IPv6 addresses, CIDR ranges and from-to ranges, and matches IPv6 entries against IPv6 traffic. If an entry cannot be parsed, DSS skips it and writes a log line naming the entry and the reason; the rest of the list is still loaded. The web platform currently sends only the IPv4 entries to DSS (IPv6 entries are left out until every DSS deployment runs this parser), so today IPv6 entries do not reach DSS, while IPv4 CIDR ranges, from-to ranges and single addresses all take effect. DSS can also have ranges set directly in its own configuration file (InternalNetworks in config.ini). Those apply in addition to the list on this page.
• No push – The web platform does not notify other components when this list changes. Each component reads the list when it needs it.
• Past data – Existing attack records are not reclassified.

Notes

• Unique values. A value cannot match another internal network.
• IPv6 is for the dashboard only, for now. IPv6 networks can be entered, but only IPv4 entries are sent to DSS today.
• Read-only access. Users with only View Settings can browse and search the list but cannot change it.
• “Administrators” entry. A network named “Administrators” cannot be edited or deleted on this page.

Related Pages

• Administration – Overview of all administration sections.
• Allowlist – Trusted addresses that are never blocked automatically.
• Blocklist – Addresses that are currently blocked.
• DSS – Settings for the DSS detection engine that uses these ranges.
• Statistics – Dashboard charts where internal addresses are not geolocated.