Add Rule or Edit Rule, Add Group or Edit Group page

You can configure firewall rules to block or allow traffic, specify networks and executables, and optionally display alerts. Groups can be location-aware. Both rules and groups can be enabled and disabled on a schedule.

Option definitions
Section	Option	Definition
Description	Name	Specifies the descriptive name of the item (required).
	Status	Enables or disables the item.
	Specify actions	Allow — Allows traffic through the firewall if the item is matched.
		Block — Stops traffic from passing through the firewall if the item is matched.
		Treat match as intrusion — Treats traffic that matches the rule as an intrusion and displays an alert. (Windows & Linux only) Best practice: Don't enable this option for an Allow rule because it generates many alerts.
		Log matching traffic — Treats traffic that matches the rule as a detection and displays an event in the Event Log on the Trellix Endpoint Security (ENS) Client. Firewall also sends an event to Trellix ePO - On-prem.
	Direction	Specifies the direction: Either — Monitors both incoming and outgoing traffic. In — Monitors incoming traffic. Out — Monitors outgoing traffic.
	Notes	Provides more information about the item.
Location (Windows & macOS only)	Enable location awareness	Enables or disables location information for the group.
	Name	Specifies the name of the location (required).
	Enable connection isolation (Windows only)	Blocks traffic on network adapters that don't match the group when an adapter is present that does match the group. Note Settings for Transport and Executables aren't available for connection isolation groups. One use of this option is to block traffic generated by potentially undesirable sources outside the corporate network from entering the corporate network. Blocking traffic in this way is possible only if a rule preceding the group in the firewall hasn't already allowed it. When connection isolation is enabled and a NIC matches the group, the group allows traffic only when one of the following applies: Traffic matches an Allow Rule before the group. Traffic traversing a NIC matches the group and there is a rule in or below the group that allows the traffic. If no NIC matches the group, the group is ignored and rule matching continues.
	Require that Trellix ePO is reachable	Enables the group to match only if there is communication with the Trellix ePO - On-prem server and the FQDN of the server has been resolved. To determine whether the Trellix ePO - On-prem server is available, Firewall performs DNS and WINS queries for the Trellix ePO - On-prem server name, which is registered with Trellix Agent. If both WINS and DNS fail to resolve the name, the Trellix ePO - On-prem server is not available.
	Location criteria	Note If you specify more than one location-criteria parameter, all are applied to the location-aware group. Connection-specific DNS suffix — Specifies a connection-specific DNS suffix in the format: `example.com`. Default gateway — Specifies a single IP address for a default gateway in IPv4 or IPv6 format. DHCP server — Specifies a single IP address for a DHCP server in IPv4 or IPv6 format. DNS server — Specifies a single IP address for a domain name server in IPv4 or IPv6 format. Primary WINS server — Specifies a single IP address for a primary WINS server in IPv4 or IPv6 format. Secondary WINS server — Specifies a single IP address for a secondary WINS server in IPv4 or IPv6 format. Domain reachability (HTTPS) — Requires that the specified domain is reachable using HTTPS. To determine whether the domain is reachable, Firewall checks for the valid SSL certificate of the domain. The location-aware group criteria matches and the rules are applied only if the domain has a valid certificate. Example formats: IPv4 — `192.168.254.200` IPv6 — `FD4A:A1B2:C3D4::E5F6` (Windows only) Note IPv6 addresses are supported on Windows systems only.
	Registry key (Windows only)	Specifies the registry key and key value. In the first field, specify the registry key in the format: `<ROOT>\<KEY>\[VALUE_NAME]` <ROOT> — Must use the full root name, such as HKEY_LOCAL_MACHINE, and not the shortened HKLM. <KEY> — Is the key name under the root. [VALUE_NAME] — is the name of the key value. If no value name is included, it is assumed to be the default value. In the second field after the equal sign, enter the data for the key value. To copy a registry key for pasting, right-click a key in the Registry Editor (run `regedit`) and select Copy Key Name.
Networks		Specifies the network host options that apply to the item.
	Network protocol	Specifies the network protocol that applies to the item.
	Any protocol	Allows both IP and non-IP protocols. If a transport protocol or an application is specified, only IP protocols are allowed.
	IP protocol	Excludes non-IP protocols. IPv4 protocol IPv6 protocol (Windows only) If neither checkbox is selected, any IP protocol applies. Both IPv4 and IPv6 can be selected for Windows systems.
	Non-IP protocol (Windows only)	Includes non-IP protocols only. Select EtherType from list — Specifies an EtherType. Specify custom EtherType — Specifies the four-characters of the hexadecimal EtherType value of the non-IP protocol. See Ethernet Numbers for EtherType values. For example, enter 809B for AppleTalk, 8191 for NetBEUI, or 8037 for IPX.
	Connection types (Windows & macOS only)	Indicates if one or all connection types apply: Wired Wireless Virtual A Virtual connection type is an adapter presented by a VPN or a virtual machine application, such as VMware, rather than a physical adapter. For the list of VPN software tested with Firewall on macOS systems, see KB78813.
	Specify networks	Specifies the networks that apply to the item. Add (Local) — Creates and adds a local network. Add (Remote) — Creates and adds a remote network. Add from Catalog (Local) — Adds a local network from the Firewall Catalog. Add from Catalog (Remote) — Adds a remote network from the Firewall Catalog. Edit — Changes the selected item. Delete — Removes the network from the list. Break Catalog Inheritance — Breaks the connection of the network to the Firewall Catalog if it was added from the catalog. Add to Catalog — Adds the network to the Firewall Catalog.
Transport		Specifies transport options that apply to the item.
Transport	Transport protocol	Specifies the transport protocol associated with the item. Select the protocol, then click Add to add ports. All protocols — Allows IP, non-IP, and unsupported protocols. TCP and UDP — Select from the drop-down: Local port — Specifies the local traffic service or port to which the item applies. Remote port — Specifies the traffic service or port on another computer to which the item applies. Local port and Remote port can be: A single service. For example, 23. A range. For example, 1–1024. A comma-separated list of single ports and ranges. For example, 80, 8080, 1–10, 8443 (up to 4 items). By default, rules apply to all services and ports. ICMP — In the Message type drop-down, specify an ICMP message type. See ICMP. ICMPv6 (Windows only) — In the Message type drop-down, specify an ICMP message type. See ICMPv6. Other (Windows only) — Selects from a list of less common protocols.
Applications (Windows & macOS only)		Specifies the applications that apply to the rule. Add — Creates and adds an application. Add from Catalog — Adds an application from the Firewall Catalog. Edit — Changes the selected item. Break Catalog Inheritance — Breaks the connection of the application to the Firewall Catalog if it was added from the catalog. Add to Catalog — Adds the application to the Firewall Catalog.
Schedule (Windows & Linux only)		Specifies schedule settings for the rule or group.
	Enable schedule	Enables the schedule for the timed rule or group. When the schedule is disabled, the rule or rules in the group, don't apply. Start time — Specifies the start time to enable the schedule. End time — Specifies the time to disable the schedule. Days of the week — Specifies the days of the week to enable the schedule. For start and end times, use a 24-hour clock style. For example, 13:00 = 1 p.m. You can either schedule Firewall timed groups or allow the user to enable them from the Trellix system tray icon. (Windows only)
	Disable schedule and enable the group from the Trellix system tray icon (Windows only)	Specifies that the user can enable the timed group for a set number of minutes from the Trellix notification area icon instead of using the schedule. Best practice: Use this option to allow broad network access, for example at a hotel, before a VPN connection can be established. Selecting this option displays more menu options under Quick Settings in the Trellix notification area icon: Enable Firewall Timed Groups — Enables timed groups for a set amount of time to allow access to the Internet before rules restricting access are applied. When timed groups are enabled, the option is Disable Firewall Timed Groups. Each time you select this option, you reset the time for the groups. Depending on settings, you might be prompted to provide the administrator with a reason for enabling timed groups. View Firewall Timed Groups — Displays the names of the timed groups and the amount of time remaining for each group to be active.
	Number of minutes (1-60) to enable the group (Windows only)	Specifies the number of minutes (1–60) that the timed group is enabled after selecting Enable Firewall Timed Groups from the Trellix notification area icon.