CLI

This guide explains how to use the SSH command-line interface (CLI) of the MetaDefender Industrial Firewall (MDIF). It is written to be read top-to-bottom the first time, then used as a reference. The same CLI runs on every MDIF model — only the port labels differ.

1. Key concepts

Five things make everything else click. Read this section once and the rest of the guide will make sense.

1.1 Connecting

Open an SSH session with any client (PuTTY, OpenSSH, …). The CLI starts automatically when you log in:

The text before the > is your device's hostname. OPSWAT15> is used throughout this guide as an example prompt.

1.2 The prompt tells you where you are

The CLI is a tree. You start at the root prompt, where you can view everything but change nothing. To make changes you step into a configuration context with a configure … command — the prompt changes to show where you are. top jumps back to the root from anywhere; exit leaves the current context (or logs you out from the root).

Each configure … command and the area it controls:

1.3 The most useful key: ?

You never have to memorize the command tree. At any prompt, type ? to list every command available right where you are, each with a short description. Press Tab to auto-complete a partly-typed command. Because the available commands change with your context — and with your role — ? always shows exactly what you can do here and now.

(The exact commands and wording depend on your device model and your role — non-administrators see only show and diagnostic commands.)

1.4 Routing vs. Transparent — the one distinction to know

Every data port runs in one of two modes, and many commands come in a routing and a transparent flavor:

• Routing — the port has its own IP address and the firewall routes traffic between subnets (like a traditional router/firewall).

• Transparent — two ports are bridged into a transparent pair; the firewall inspects traffic passing through the bridge without having an IP on those ports (a "bump in the wire").

Run show firewall ports at any time to see which mode each port is in. If a command or setting says "routing" or "transparent", it applies only to ports in that mode.

1.5 How to read the command syntax in this guide

1.6 Who can run what

• Administrators (privilege level 15) get the full CLI — all show, configure, and maintenance commands.

• Non-administrators get a read-only CLI: only show and diagnostic commands. Every write command and configuration context is hidden from ?/Tab and rejected if typed. CLI access is granted per-user under Settings → User Management in the web UI.

2. Your first session

This short walkthrough shows the rhythm of almost every change: look → enter a context → change → preview → save → verify. It adds one firewall rule and confirms it. Commands you type are after the >; everything else is the device's response. Tip: at any point, press ? to see what you can type next (see §1.3).

Step 1 — See your ports. Start by learning the port names on your device:

Step 2 — Look at the current rules (so you have a "before" picture):

Step 3 — Enter the firewall context and add a rule. This one allows HTTPS (TCP/443) from one host to a subnet, routed from the LAN port to the SFP port:

Step 4 — Verify, then return to the root. List the rules again and confirm your new one is there:

That's the whole loop. Some areas (interfaces, NTP, DPI profiles) build a change field-by-field and ask you to type show to preview and save to commit — you will see that pattern in the next section. Nothing is applied until you save (or, for one-line commands, until the command returns a * success line).

On an 8-port device the labels are Port 1–Port 6 and SFP 1/SFP 2 — type them with a dash (Port-1). The 4-port labels (LAN/DEVICE/SFP/Management) are used in the examples below.

3. Common tasks

Copy-paste recipes for the things people do most. Each links to the full command reference for every option.

3.1 Add or remove a firewall rule

Full options, the interactive form, and transparent/Ethernet rules: see Reference §4.2–4.4.

3.2 Give a routing interface an IP address

Details and port-mode changes: see Reference §4.10.

3.3 Add an NTP server

min and max (poll-interval exponents, 3–17) are required. See Reference §4.11.

3.4 Create a reusable IP object

You can then use HQ-Network wherever a rule expects a source/destination. See Reference §4.6.

3.5 Add a DPI profile (allowed function codes)

All protocols and their add syntax: see Reference §4.5.

3.6 Tune a DoS protection

Every protection and its limits: see Reference §4.14.

3.7 Back up the configuration to USB

Import, firewall-rule transfer, and encryption notes: see Reference §4.16.

4. Command reference

Every command, grouped by area. Concepts (prompts, the ? help key, routing vs transparent, syntax notation) are explained in §1.

4.1 Viewing configuration (the show family)

show commands display current state, can be run from any prompt, and are available to every user.

Example — show firewall ports on an 8-port device (4-port output is shown in §2):

4.2 Firewall rules

All rule operations are under configure firewall. Routing rules apply between two routing-mode ports; transparent rules apply on transparent-bridge ports (IP rules here; MAC rules in §4.4).

Single-line form:

Source / destination accept the literal any, an IPv4 address (192.168.1.10), a CIDR subnet (192.168.10.0/24), a range (192.168.10.5-192.168.10.50), or the name of an IP object (§4.6).

Activity (OT protocols): for protocols like Modbus, OPC-UA, EtherNet/IP, DNP3, BACnet, GOOSE, SV, PROFINET, S7Comm, OPC-Classic and BN3500, the optional [activity] restricts what operations are allowed. Run show firewall activities <protocol> for the valid levels; if omitted, the most permissive level is used.

Interactive form — omit the trailing arguments to build a rule field-by-field, previewing with show and committing with save:

4.3 Delete, enable, or disable a rule

Rules are addressed by the No. column from show firewall routing-rules / transparent-rules. Numbers renumber after a delete, so re-run show before the next delete.

4.4 Transparent-mode Ethernet (MAC) rules

Layer-2 rules that match on source/destination MAC, between two transparent ports. Under configure firewall:

<action> is allow or block. MACs may be colon-, dash-, or no-separator form (normalized to lowercase colon form); use any to match all. Example: rule add transparent-ethernet LAN DEVICE aa:bb:cc:dd:ee:ff any allow.

4.5 DPI profiles

A DPI profile lists the protocol function codes / methods that are permitted. Manage under configure firewall; inspect with show firewall dpi-codes <protocol> and show firewall dpi-profile <protocol>.

• codes / <list> = comma-separated integers, e.g. 1,3,5,15.

• methods = comma-separated method names, e.g. Read,Browse,Write.

• entries = comma-separated EtherNet/IP entries, each fc:svc:inst[:pccc+pccc+...].

• sdi/tdi = BN3500 channel IDs.

4.6 IP address objects

Named, reusable address groups. A rule that references an object always uses the object's current value — change the object and every rule using it updates. Under configure firewall:

Names are alphanumeric / underscore / hyphen, case-insensitive when referenced, and must be unique. Deleting an object that a rule uses prints a warning listing the affected rules.

4.7 Flow learning & protected assets

Flow Learning Mode (FLM) lets the device learn OT traffic and protected assets. Routing and transparent modes have independent settings, under configure firewall.

4.8 Routing-mode firewall settings

Global routing controls, under configure firewall (view with show firewall routing-settings):

• forward-policy — default action for unmatched traffic.

• log-limit — rate-limit firewall log entries (per-second).

• bandwidth-limit — throttle forwarded traffic; <unit> e.g. mbit.

4.9 Transparent-mode firewall settings

Global transparent toggles, under configure firewall (view with show firewall transparent-settings):

Block L2 drops all Layer-2 traffic including ARP, which stops ICMP/IP forwarding too. Enable it only when you intend to block all non-allowlisted L2 traffic on the bridge.

4.10 Network settings

Per-interface IP configuration for routing interfaces, and port-mode changes, under configure network. (Transparent ports show N/A for IP columns; the management interface IP is changed with configure management — see §4.17.)

The default gateway is a single device-wide route. If another interface already owns it, setting a gateway on a second routing port is rejected.

4.11 Time settings

Under configure time (view with show time / show time ntp):

The NTP source interface must be a routing or management interface (transparent ports have no IP). min and max are the poll-interval exponents (3–17) and are required — the web UI marks both fields required, so the CLI rejects an ntp add that omits either.

4.12 Management Access rules

Rules that govern access to the device's own management plane, under configure management-access (view with show management-access):

Example: rule add http-server2 inbound Allow tcp any 192.168.100.0/24 8002

Predefined system-rule categories (Management, OSPF, …) cannot be deleted, edited, enabled, or disabled. Only the USER rules you create can be changed.

4.13 ARP Protection

IP-MAC bindings and ARP validation, under configure arp-protection (view with show arp-protection):

Bindings exclude the management interface.

4.14 DoS / DDoS Protection

Per-protection thresholds, under configure dos (view with show dos or show dos tcp|udp|icmp). limit is packets-per-second; burst (where supported) is the burst allowance. DoS protection applies in both routing and transparent modes.

4.15 System settings

Under configure system (view with show system settings):

4.16 Backup, restore & configuration transfer

Export configuration backups and firewall-rule sets to a removable USB drive, and import them back. These run from any prompt and only ever touch a removable USB partition — never an internal disk. Encryption is prompted interactively (the password is never on the command line).

Before you start: the USB port must be enabled and exactly one USB drive inserted. If the port is off, these commands report * USB port is disabled. Enable it with \ usb enable and try again.— run usb status to check and usb enable to turn it on (see §4.17).

Import/Export supports the following file types for configuration backups, firewall rules, and system backups:

• Configuration backup: plaintext .json or encrypted .json.bin

• System backup: encrypted .bin only. System backups are always encrypted on export.

• Firewall rules: plaintext .json or encrypted .json.enc

4.17 Other commands

Also available; some are destructive — consult your administrator first.

Destructive operations — factory_reset, software apply, configure management, erase, and bypass can disconnect or erase device state. The CLI records the operator and command in the audit log before the operation begins, so it is traceable even if your session drops.

5. Audit trail

Every command you type is recorded for compliance and forensics:

6. Error messages

The CLI is hardware-agnostic — the same commands work on the 4-port and 8-port models; only the port labels differ.