Apps & Categories¶
Apps & Categories lets you control traffic by what it is — Netflix, TikTok, gambling sites, social media — instead of by IP address. You pick an app or a category by name, and the router works out which domains and networks belong to it.
mFusion maintains a database of applications and categories (the app database): which domains belong to which app, and which category each app belongs to. You can add your own Custom Apps for internal or regional services the database does not know. Routers download the lists they need from mFusion and keep them up to date automatically. mFusion also uses the app database and your Custom Apps to label Client Flow usage by app and category on the Usage Dashboard.
You can use apps and categories in three places:
| Feature | What it does | Typical use |
|---|---|---|
| DNS Filter | Blocks or permits the app's or category's domains when clients look them up; optionally only for some client networks | Block gambling and adult sites for all users; block TikTok for the staff network only |
| Traffic Steering | Sends the app's or category's traffic out of a chosen link (Policy-Based Routing) | Send streaming video over a second WAN, keep business apps on the primary link |
| Firewall rules | Permits or denies connections to the app's or category's addresses | Deny an app on a guest network at the connection level |
Usage Reporting¶
The same database, with your Custom Apps, also classifies usage reporting. Routers with Client Flow enabled upload each client's traffic to mFusion. The Usage Dashboard then labels every destination with its app and category by hostname, or by the owner of its IP range (for example "Google LLC"), and totals usage per category and per app.
Usage reporting needs no rule or list on the router: mFusion classifies the destinations itself, at the time the dashboard shows them. An app database update therefore also relabels past usage.
Custom Apps label usage too, and take priority over the app database: a destination whose hostname is one of a Custom App's domains (or a subdomain of one), or whose IP address is in one of its networks, is shown as that Custom App, tagged custom.
How It Works¶
- mFusion holds the lists. The app database ships with each mFusion release and can be updated online between releases (Check for Updates). Custom Apps you create are added to the same lists.
- You reference apps and categories by name in a DNS Filter rule or in a Firewall Object group — from the mFusion GUI or the router CLI, e.g.
dns-filter 100 deny category "Gambling and Betting". - The router downloads each list it uses from mFusion in the background. It checks every 10 minutes and downloads a list again only when it changed (an app database update, or an edit to a Custom App). A CLI command never waits for the download.
- The router applies the lists:
- DNS Filter — the router's DNS server answers
0.0.0.0for denied domains (and all their subdomains). - Object groups — the object's address set gets the app's own networks, plus the IP addresses its domains resolve to as clients look them up. Steering and firewall rules then match those addresses.
- DNS Filter — the router's DNS server answers
If mFusion is unreachable (for example at boot, before the WAN is up), the router keeps using the lists it already has and tries again on the next check.
App and category names
Names are used exactly as shown in Apps & Categories — letters, digits, spaces, ., _ and -. A name with spaces is quoted in the CLI: category "Streaming and Entertainment". A Custom App with the same name as an app in the app database replaces it.
Requirements¶
| Item | Requirement |
|---|---|
| mFusion | Debian 12 mFusion with the Apps & Categories release (menu ORCHESTRATOR → Apps & Categories). |
| Online app database updates | Outbound HTTPS from mFusion to GitHub (api.github.com, codeload.github.com). Without it, the app database is updated with each mFusion upgrade. |
| Routers | Firmware with Apps & Categories support, registered to the mFusion (routers download lists from their own mFusion over HTTPS). |
| Clients | For DNS Filter and for steering on branch routers: clients must use the router as their DNS server, or the router must redirect client DNS to itself. See Web Filtering — Prerequisites. |
Platform Support¶
| Capability | Gateway series (HSG, CMG — Debian 12) | Branch series (UA-520, HSA-520) | XE-300 |
|---|---|---|---|
| DNS Filter with apps and categories | Yes | Yes | Yes |
| DNS Filter Source networks | Yes, no limit | Yes, up to 4 networks | Yes, up to 4 networks |
| Object groups: the app's own networks | Yes | Yes | Yes |
| Object groups: IPs learned from DNS answers | Yes — also for clients using another DNS server | Yes — clients must use the router's DNS | No — the app's networks only |
| Exact host names in a list | Matched exactly | Also match their subdomains | Also match their subdomains |
Note
On branch routers, the DNS server learns an app's IP addresses only from the lookups it answers itself. The gateway series watches all DNS answers passing through the router, so it also learns from clients that use an external DNS server (for example 8.8.8.8).
In This Section¶
| Page | Description |
|---|---|
| Managing Apps & Categories | Browse categories and apps, create Custom Apps, look up a hostname or IP, update the app database |
Best Practices¶
- Block with DNS Filter, steer with object groups — DNS Filter matches names exactly. Object groups match by IP address, and large services share CDN addresses: a firewall deny on a category can also block an unrelated site hosted on the same CDN address.
- Make clients use the router for DNS — set the router as the DHCP DNS server, or redirect DNS to the router. Otherwise clients that use an external DNS server bypass DNS Filter.
- Block encrypted DNS where filtering matters — the Encrypted DNS category lists DNS-over-HTTPS resolvers; deny it in DNS Filter, and block outbound TCP port 853 (DNS-over-TLS) with a firewall rule.
- Prefer categories to long app lists — a category follows app database updates automatically, so new apps in the category are covered without config changes.
- Keep management access restricted — the router downloads lists from mFusion over HTTPS; it needs no inbound access. See Device Hardening.