VLAN an Firewall rule not matching
-
@interessierter You sure your not seeing a error about memory? You sure look to have a lot of aliases..
And none of your rules show any hits at all - they all show 0/0 for states.
When you have lots entries in your tables - it can cause a memory issue.
There are many a thread related to this about. Here for example
Have you increased your table entries?
This setting is system / advanced / firewall & nat
-
This post is deleted! -
@bob-dig said in VLAN an Firewall rule not matching:
It looks like an alias can't start with a number
Looks to be working here..
-
@johnpoz You are right, I had no rule using it. Working here too.
-
@bob-dig no problem - it was a good check to be sure.
if I had to "GUESS" from how many aliases he has setup, and I see some there labeled IPv6, etc..
He needs to adjust his max table entries.. Maybe his not seeing the error that should show up when rules don't load because of allocation of memory.. I would assume that TOP_v6 rule would be quite large..
I also don't like that none of his rules showing any hits at all 0/0 there for states..
His any any IPv4 rule he shows for sure should show something vs 0/0.. That is if anything is hitting that interface at all for traffic. But tables in rules don't actually have to trigger to populate - they just need to be used in a rule. And the rules reloaded, which would happen when you hit apply.
-
@johnpoz said in VLAN an Firewall rule not matching:
@bob-dig no problem - it was a good check to be sure.
if I had to "GUESS" from how many aliases he has setup, and I see some there labeled IPv6, etc..
He needs to adjust his max table entries.. Maybe his not seeing the error that should show up when rules don't load because of allocation of memory.. I would assume that TOP_v6 rule would be quite large..
I also don't like that none of his rules showing any hits at all 0/0 there for states..
His any any IPv4 rule he shows for sure should show something vs 0/0.. That is if anything is hitting that interface at all for traffic. But tables in rules don't actually have to trigger to populate - they just need to be used in a rule. And the rules reloaded, which would happen when you hit apply.
I can change the name of the alias. This appliance have 16GB memory, and the utilization show 9%.
-
@interessierter said in VLAN an Firewall rule not matching:
This appliance have 16GB memory, and the utilization show 9%.
that has nothing to do with the max entries that can be put into a table.. Well almost nothing ;) Check the max table entries I showed.. Increase it!! To something quite large.. Or turn off all your other pfblocker aliases, etc.. See mine is set to 1.6Million ;)
What I can tell you for sure - is if the table does not show populated in the diagnostic menu - its never going to be able to do anything in a rule with that table.
-
@johnpoz said in VLAN an Firewall rule not matching:
@interessierter said in VLAN an Firewall rule not matching:
This appliance have 16GB memory, and the utilization show 9%.
that has nothing to do with the max entries that can be put into a table..
I have changed the Name, it still does not show in the table. By the way I don t see ANY of the Alias and IP section in the table under Diagnostics. The only lists that I see if from snort, and all that is added under Alias / URL
-
@interessierter If you do not see any table populated - that also points to a problem - most likely related to your max table size.
What is it set to currently? Increase it to something very large!!
-
@johnpoz this here?
-
@interessierter Is this my problem?
-
@interessierter yeah that there.. Well 2mil should be quite large, unless you have more aliases not showing?
-
@interessierter why would you have that set? That would only ever be used if you were running multiple layer 3 on the same layer 2..
And that sure shouldn't have anything to do with the tables loading.
-
@johnpoz said in VLAN an Firewall rule not matching:
@interessierter yeah that there.. Well 2mil should be quite large, unless you have more aliases not showing?
non of my custom alias is showing. What should I set?
-
@interessierter what I would suggest is for testing turn off all your pfblocker aliases, since they can be large.. I would also turn off bogonV6 if you have that enabled. Also another one that can just be freaking huge.
I doubt that bypass firewall rules has anything to do with it.. Because I just set it, and still see my tables populated.. Even after filter reload. But unless you have specific use case for that - it shouldn't be enabled. It sure isn't enabled by default.. Not sure why you would of turned that on?
I would then do a filter reload - under status.. Do you see any errors on loading anything?
If your tables are not populated there is no way they could be used in rules..
-
@johnpoz said in VLAN an Firewall rule not matching:
@interessierter what I would suggest is for testing turn off all your pfblocker aliases, since they can be large.. I would also turn off bogonV6 if you have that enabled. Also another one that can just be freaking huge.
I doubt that bypass firewall rules has anything to do with it.. Because I just set it, and still see my tables populated.. Even after filter reload. But unless you have specific use case for that - it shouldn't be enabled. It sure isn't enabled by default.. Not sure why you would of turned that on?
I would then do a filter reload - under status.. Do you see any errors on loading anything?
If your tables are not populated there is no way they could be used in rules..
I get this one at the end:
Loading filter rules
Setting up logging information
Setting up SCRUB information
There were error(s) loading the rules: /tmp/rules.debug:135: could not parse host specification - The line in question reads [135]: rdr pass on igb2 inet6 proto tcp from any to ::1010101 port 80 -> ::1 port 8081 -
@interessierter said in VLAN an Firewall rule not matching:
There were error(s) loading the rules: /tmp/rules.debug:135: could not parse host specification - The line in question reads [135]: rdr pass on igb2 inet6 proto tcp from any to ::1010101 port 80 -> ::1 port 8081
Oh and the plot thickens..
What specific rule is that?
-
@johnpoz said in VLAN an Firewall rule not matching:
@interessierter said in VLAN an Firewall rule not matching:
There were error(s) loading the rules: /tmp/rules.debug:135: could not parse host specification - The line in question reads [135]: rdr pass on igb2 inet6 proto tcp from any to ::1010101 port 80 -> ::1 port 8081
Oh and the plot thickens..
What specific rule is that?
I guess we coming close. Today my Internet was working fine, after I removed and re-enabled the pfnblocker, my Internet was not working anymore. It seems like I deleted the DNS port rule from my lan last weekend, but it took now effect. Crazy
How to find out? I have no rule with 8081, and the normal Port 80 rule looks normal
-
@interessierter do you have your webgui on port 8081? I think there is a redirect for 80 to whatever the port is set too.
I have mine disabled.. But this was thing that came to mind that would redirect 80 like that.
-
@johnpoz said in VLAN an Firewall rule not matching:
@interessierter do you have your webgui on port 8081? I think there is a redirect for 80 to whatever the port is set too.
I have mine disabled.. But this was thing that came to mind that would redirect 80 like that.
no on 81, but that is maybe reason for 8081? I wonder about 41MB in this rule:
