Firewall Invert Match question

[CallFromUSA]

Hello I need more information on this option on the Firewall rule. I wanted to know whats its function is? Does it concern stateful and stateless Firewalling? And IF yes which is PFsense? I looked for it on google couldnt get it.

Thanks

[kpa]

If you look more closely to the UI you'll see that the invert match checkboxes are in the "source address" and "destination address" parts of the rule edit window. This means the inversion applies only to the addresses, i.e. "match any address except the one(s) listed".

[CallFromUSA]

@kpa:

If you look more closely to the UI you'll see that the invert match checkboxes are in the "source address" and "destination address" parts of the rule edit window. This means the inversion applies only to the addresses, i.e. "match any address except th. e one(s) listed".

Thanks for your reply. could you please give some more info on what you meant by "match any address except th. e one(s) listed"? thanks.

[cmb]

It inverts the match. Say you add a rule allowing any source to destination 8.8.8.8, that allows traffic to 8.8.8.8. Change that to inverted destination and it's allow to destination not 8.8.8.8 - e.g. anything but 8.8.8.8.

[MMapplebeck]

Further to this, and I feel really dumb for asking, perhaps because it's Friday, and I'm on my 3rd coffee.

Does the Invert option only apply to the source/destination address line?

Example, I want to make my rule reject outbound HTTPS traffic, except HTTPS destined for an alias for our company subnets.

Will the rule shown as is attached:

a. Reject ALL traffic on the LAN interface, except HTTPS traffic destined for net_internal?
OR
b. Reject ALL HTTPS traffic on the LAN interface, except if the destination matches net_internal?


[cmb]

That rule will reject all traffic except HTTPS to destination net_internal. It won't pass HTTPS to net_internal though, you need a pass rule for that, it just won't reject it (as it won't match the rule).

[MMapplebeck]

That's excellent!  We already have an allow all outbound rule, we just want to block internet HTTPS traffic that is not passed through our proxy.