Please check my configuration and Rule orders

eeebbune

Hello Professionals,

As far as I know about rule priorities of PFSense FW is,

- Floating Rules ( Quick )
- Interface port Rules (Interface Group)
- Floating Rules ( Non - Quick, Last match )

So I have Floating quick rules - Interface rules (2 ports bridging) - Non Floating quick rule and it works great what I expected and have planed.

For Non-Floating quick rule, I have only one.

This rule is for last match, and this rule blocks all except Non-Floating quick/Interface (Allow)rules.
Currently I made a direction 'in', but when I changed it to be bi-direction (any),
Suddenly my Interface allow rules were ignored, and it blocked.

Why is this happened? Why my bi-direction config had high priority than interface(bridge) rules?
Did I miss something?

I appreciate your reply.

dma_pf

@eeebbune I personally do not use floating rules as the general advice is to use more explicit rules on individual interfaces.

However, based on my reading of this (link)

I think that what you have here might be incorrect:

I think the correct order is:

Floating Rules (Quick)
Floating Rules (Non-Quick, Last Match)
Interface Group Rules
Interface Rules

More info on the rules processing order can be found here : https://docs.netgate.com/pfsense/en/latest/firewall/rule-methodology.html#rule-processing-order

If I am correct, then it would appear to me that what might be happening is that in the "any" direction all traffic is being blocked by your rule and the traffic never makes it to the interfaces.

Bear in mind that I have minimal experience with floating rules and would certainly defer to others that have more experience with them.