Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Strange behaviour with alias firewalling: Pass is logged but traffic is blocked

    Scheduled Pinned Locked Moved Firewalling
    1 Posts 1 Posters 37 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      Dakpan
      last edited by

      Today I'm facing a weird behavior on one of our PF boxes, this one is a 2.7.2 release, but I had it before on an other box as well a month ago. A generic explanation:

      We have an IP alias "Abuse_IPs" containing some IP's and FQDN's of abusive IP's.
      On our WAN interface we have a simple block any rule when source is Abuse_IPs.

      An accidentally added FQDN in this alias needed to be removed. Before removal the address was blocked and logged as blocked, as it should. After removing the entry, the address starts appearing as allowed in the firewall log, but the traffic is still blocked somewhere. Packet captures on the "next hop" show no traffic coming from the PF towards the allowed IP.
      Rebooting the PF fixed the problem previously.

      I tried reloading the filter, flushing the states, but it has no use, only a reboot seems to fix the problem.

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.