> For the complete documentation index, see [llms.txt](https://pango.gitbook.io/paas/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pango.gitbook.io/paas/console-details/project-settings/fireshield.md).

# Fireshield

## Enable Fireshield in Pango Cloud

![Fireshield Console Settings](/files/MZ6JXgpJApjbmVvxAEfm)

{% hint style="warning" %}
Fireshield is not available for all projects by default. The Fireshield settings page will not appear in your console until it has been activated for your project by a Pango representative. Contact your Pango representative to request activation.
{% endhint %}

To enable Fireshield for your project:

1. Open the **Pango Cloud** console and navigate to your project settings.
2. Toggle the Fireshield option to enable or disable it. This requires a **project admin** or **owner** role.

Once enabled, a per-project configuration is generated and delivered to client devices automatically when the SDK retrieves VPN credentials.

{% hint style="info" %}
Enabling Fireshield in the console is not sufficient on its own. The client application must also enable Fireshield on the SDK side by passing a Fireshield configuration object (with the `enable` parameter set) to the SDK method that retrieves remote config and credentials. If no configuration object is passed, Fireshield is disabled by default.

For platform-specific setup, see [Fireshield SDK Integration](/paas/sdk/unified-vpn-sdk/features/fireshield.md#enabling-fireshield).
{% endhint %}

## Configure Filtering Rules

After enabling Fireshield, you can define rules that control how traffic is handled based on content categories.

### Setting Up Rules

1. Select a **category** from the available list (e.g., `malicious`, `phishing`, `fraud`).
2. Assign an **action** to each category:
   * **block\_dns** -- Block the domain at the DNS and HTTP level.
   * **proxy\_peer** -- Route through the VPN tunnel.
   * **bypass** -- Send directly through the local network.
3. Arrange rules in **priority order**. The first matching rule is applied when a domain belongs to multiple categories.

### Required Rules

Every rule set must include:

* A **default** rule -- applied when no other category matches.
* An **error** rule (optional) -- applied when the categorization service encounters an error.

Place `error` and `default` rules at the end of the rule list.

### Available Categories

For the full list of supported categories and actions, see [Fireshield Categories and Actions](/paas/sdk/unified-vpn-sdk/features/fireshield.md#categories).

## More Information

For details on integrating Fireshield into your client application, see [Fireshield SDK Integration](/paas/sdk/unified-vpn-sdk/features/fireshield.md).