Advanced rules

Open Network configuration > Advanced.

Advanced rules are for users who need more control than the ready-made profiles provide.

Caution

Custom rules can block real users or your own access. Create one rule at a time and test immediately.

Basic inputs

Input	Meaning	Example
Rule name	A label so you can recognize the rule later.	Drop QUIC 443
Protocol	Traffic type to match.	TCP, UDP, QUIC
Action	What happens when traffic matches.	Drop or Allow
Source IPv4/CIDR	Sender IP or subnet.	203.0.113.0/24
Destination IPv4/CIDR	Local destination IP or subnet.	198.51.100.10

Leave a field empty when you do not want to match by that field.

Protocol-specific inputs

Protocol	Inputs
TCP	Source port, destination port, and TCP flags.
UDP	Source port and destination port.
QUIC	UDP source or destination port, usually destination port 443.
ICMP / ICMPv6	ICMP type and code.
GRE, ESP, AH	No port input. These are matched by protocol.

TCP flags

Flag	Meaning
SYN	New connection attempt. Useful for connection-flood rules.
ACK, RST, PSH, FIN, URG	Advanced TCP matching. Leave these empty unless you know you need them.

Packet length inputs

Input	Meaning
Min packet length	Match packets at least this size.
Max packet length	Match packets no larger than this size.

Rate limit inputs

Input	Meaning
Source IP PPS	Packets per second from one source IP.
Source IP BPS	Bytes per second from one source IP.
Flow PPS	Packets per second for one source IP and port flow.
Flow BPS	Bytes per second for one source IP and port flow.

Start with higher limits and lower them after you know normal traffic levels.

Example: block QUIC on UDP 443

Input	Value
Rule name	Drop QUIC 443
Protocol	QUIC
Action	Drop
UDP destination port	443