Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Confused about rule

    Scheduled Pinned Locked Moved General pfSense Questions
    18 Posts 5 Posters 1.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      michmoor LAYER 8 Rebel Alliance @michmoor
      last edited by michmoor

      EDIT:
      Double checked the ruleID as suggeted.
      You are correct. Rule ID 1661208833 is the same for both the block Internal and Permit to Internet. Never seen that before...
      Whats the fix? Re-create the rule?

      I changed the rule to permit any any and got rid of the negate. Did a filter reload.

      Seems to still be wonky.

      f02389e5-716a-45df-b1c7-115fd3eb996d-image.png

      a81a59cc-fc17-4ee9-b072-6ab71252b4f5-image.png

      Firewall: NetGate,Palo Alto-VM,Juniper SRX
      Routing: Juniper, Arista, Cisco
      Switching: Juniper, Arista, Cisco
      Wireless: Unifi, Aruba IAP
      JNCIP,CCNP Enterprise

      johnpozJ 1 Reply Last reply Reply Quote 0
      • J
        Jarhead @johnpoz
        last edited by

        @johnpoz said in Confused about rule:

        @jarhead I agree with you those rules are odd. But he would still be able to get to the internet since 8.8.8.8 for example would not be rfc1918, and it the ! rfc1918 would allow it.

        True but only if the devices themselves had 8.8.8.8 hardcoded as their dns. Otherwise the dns would have been blocked if it was assigned by dhcp.
        Totally moot since his first rule allowed dns anyway.
        That's what made me curious if they were the only rules.

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @michmoor
          last edited by johnpoz

          @michmoor said in Confused about rule:

          Rule ID 1661208833 is the same for both the block Internal and Permit to Internet.

          That is odd for sure... Not sure how that could happen? But yeah a delete and then recreation of the rule should correct that..

          edit:
          Did you copy the rfc1918 rule, and then just edit to !?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          R M 2 Replies Last reply Reply Quote 0
          • R
            rcoleman-netgate Netgate @johnpoz
            last edited by

            @johnpoz if it's copied in the config file and then imported this can happen.

            Ryan
            Repeat, after me: MESH IS THE DEVIL! MESH IS THE DEVIL!
            Requesting firmware for your Netgate device? https://go.netgate.com
            Switching: Mikrotik, Netgear, Extreme
            Wireless: Aruba, Ubiquiti

            1 Reply Last reply Reply Quote 0
            • M
              michmoor LAYER 8 Rebel Alliance @johnpoz
              last edited by michmoor

              @johnpoz
              this is a new interface i brought up a few days ago. I dont recall copying from another interface.
              If i did copy, then would you think that this is incorrect(buggy) behavior then? The option to copy rules from one interface to another is part of the code but the tracking ID should be changed in the process and it isnt.

              2e8e9c02-4ec1-42ad-aa01-ab3e0003fa2f-image.png

              91122c26-c33b-494e-a38a-5a9770fa3782-image.png

              I have since recreated the any any rule including the !RFC1918 negate. The rule ID is different now.
              This was a very strange one. Thanks for pointing out to double check the tracking ID.

              The good thing is that at the end of the day, the firewall was doing what it was supposed to do regardless if the metadata about the rule was incorrect.

              Firewall: NetGate,Palo Alto-VM,Juniper SRX
              Routing: Juniper, Arista, Cisco
              Switching: Juniper, Arista, Cisco
              Wireless: Unifi, Aruba IAP
              JNCIP,CCNP Enterprise

              johnpozJ R 2 Replies Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @michmoor
                last edited by johnpoz

                @michmoor local data fallback, so this a ha pair?

                Or that most likely refers to how you logged in, when updated, etc. So you radius auth failed?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                M 1 Reply Last reply Reply Quote 0
                • M
                  michmoor LAYER 8 Rebel Alliance @johnpoz
                  last edited by

                  @johnpoz Not an HA pair. I do have radius set up for local login but i logged in as admin not using my radius account

                  Firewall: NetGate,Palo Alto-VM,Juniper SRX
                  Routing: Juniper, Arista, Cisco
                  Switching: Juniper, Arista, Cisco
                  Wireless: Unifi, Aruba IAP
                  JNCIP,CCNP Enterprise

                  1 Reply Last reply Reply Quote 0
                  • R
                    rcoleman-netgate Netgate @michmoor
                    last edited by

                    @michmoor this is interesting:
                    e35a576b-8ac2-4e51-a0d1-66d4ca16c8e5-image.png

                    it says it was made on Feb. 14.

                    Ryan
                    Repeat, after me: MESH IS THE DEVIL! MESH IS THE DEVIL!
                    Requesting firmware for your Netgate device? https://go.netgate.com
                    Switching: Mikrotik, Netgear, Extreme
                    Wireless: Aruba, Ubiquiti

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      michmoor LAYER 8 Rebel Alliance @rcoleman-netgate
                      last edited by

                      @rcoleman-netgate The interface is new. I suspect the copied rules (block RFC1918 and permit !RFC1918) were copied over to this new interface.
                      It seems that in this particular case, the tracking ID was copied over as well.Its the only thing that would make sense in having a duplicate tracking ID.
                      I just tested to see if i can duplicate it and i cannot.

                      Firewall: NetGate,Palo Alto-VM,Juniper SRX
                      Routing: Juniper, Arista, Cisco
                      Switching: Juniper, Arista, Cisco
                      Wireless: Unifi, Aruba IAP
                      JNCIP,CCNP Enterprise

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Mmm, that should not happen. That's in 2.6? When that rule was created it would not have been though.

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          michmoor LAYER 8 Rebel Alliance @stephenw10
                          last edited by

                          @stephenw10 I agree steve that this condition should not happen. I gave my best theory and i tested but cant reproduce. Sucks it took me a week to even notice it so i couldve provided accurate steps to what i did but generally if im spinning up a new interface and the access rules are similar i copy the rules from another interface nstead of manually creating the rules from scratch.
                          Im on 22.05 when i copied the rules, Correct i was on 22.x previously

                          Firewall: NetGate,Palo Alto-VM,Juniper SRX
                          Routing: Juniper, Arista, Cisco
                          Switching: Juniper, Arista, Cisco
                          Wireless: Unifi, Aruba IAP
                          JNCIP,CCNP Enterprise

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Hmm, one thing that can appear like that is if you're looking at old logs and have since updated the ruleset. The rule number to rule description is created when the logs are viewed and that can change. So if you added the pass rule after the block rule or deleted another rule at some point the rule description might show incorrectly. Actual running rule numbers should still be different though.

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @stephenw10
                              last edited by johnpoz

                              @stephenw10 said in Confused about rule:

                              The rule number to rule description is created when the logs are viewed and that can change.

                              Yeah I was thinking the same thing at first - but then he showed his actual rules and the IDs were the same - very strange.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.