Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    List or toggle rules on/off via CLI

    Scheduled Pinned Locked Moved General pfSense Questions
    11 Posts 3 Posters 2.2k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S Offline
      stevemac00 @luckman212
      last edited by

      @luckman212
      Thanks for posting this and including examples.

      1 Reply Last reply Reply Quote 0
      • I Offline
        Iceman24 @luckman212
        last edited by Iceman24

        @luckman212 Any way to make this script also adjust NAT rules? I thought I was golden when I tested it, then realized I needed it for NAT rules that have linked firewall rules.

        Edit:
        Actually, disabling firewall rule would still effectively render NAT rule useless without it, so maybe that is fine.

        luckman212L 1 Reply Last reply Reply Quote 0
        • luckman212L Offline
          luckman212 LAYER 8 @Iceman24
          last edited by

          For anyone not watching the repo, I updated this to add the ability to toggle NAT rules as well with e.g. n14 as the ruleid.

          S 1 Reply Last reply Reply Quote 3
          • S Offline
            stevemac00 @luckman212
            last edited by

            @luckman212 I use this nearly every day. I have a small homebridge node script so I can use siri turn on/off the rule. Sometimes the rule is a different index and I screw something else up. I‘ve tried to find a programmatic method to get the rile Id but can’t find it. Pfctl can show but only when rule is enabled. Any other ideas?

            luckman212L 1 Reply Last reply Reply Quote 0
            • luckman212L Offline
              luckman212 LAYER 8 @stevemac00
              last edited by

              @stevemac00 It's a bit odd that the rule IDs are changing for you. Do you use pfBlocker? In any case, I could add a function to operate on rules based on the description.

              You'd want to have a unique description set for this rule. If >1 rule had the same description (eg a rule named "allow ping" that existed on 2 separate VLANs) then I'm not sure what the script should do... toggle all of them? just the first one? or error out and complain?

              S 1 Reply Last reply Reply Quote 0
              • S Offline
                stevemac00 @luckman212
                last edited by

                @luckman212 Answer yes to pfblockerng but I'm not placing any blame. If another unrelated rule is disabled (prior to this rule in the pfctl list), that action will cause this rule's index to change and therefore script will enable/disable wrong rule.

                So, I think an unambiguous keyword in description is preferable. Maybe enclose it double asterisks so my rule description could be something like
                "Automated **MBVPN** rule to enable VPN gateway for this host or alias"
                and then find by key **MBVPN**

                Thank you again for your efforts and support!

                S luckman212L 2 Replies Last reply Reply Quote 0
                • S Offline
                  stevemac00 @stevemac00
                  last edited by

                  @stevemac00 Tried this:
                  I pass your script my descriptive term MBVPN and get rule index (id)

                  ruleid=`sudo php -q /home/steve/fwrule_toggle.php -l | perl -ne 'print if s/\s{2}(\d+).{3}lan\s\(**MBVPN**\)/$1/g'`
                  

                  I'm not a perl user but seems to work.

                  luckman212L 1 Reply Last reply Reply Quote 0
                  • luckman212L Offline
                    luckman212 LAYER 8 @stevemac00
                    last edited by

                    @stevemac00 That's neat but why sudo though? I should have time later today to build in a matching function. I was also planning to accept a comma separated list of rules to allow multiple operations without forking php so many times.

                    1 Reply Last reply Reply Quote 1
                    • luckman212L Offline
                      luckman212 LAYER 8 @stevemac00
                      last edited by

                      @stevemac00 I just pushed an update that adds some features. Give it a try when you can.

                      • You can operate on rule(s) based on description now, as well as specify multiple ruleIDs as a comma separated parameter for batch operations.
                      • If >1 rule matches a description, they will be actioned as a group.
                      • Changes are output at the console as well as logged to the GUI > System Log.
                      1 Reply Last reply Reply Quote 2
                      • patient0P patient0 referenced this topic on
                      • luckman212L Offline
                        luckman212 LAYER 8
                        last edited by

                        Just a quick note, I updated my script to operate correctly on newer versions of pfSense (2.8/25.07). Let me know if you encounter any issues.

                        1 Reply Last reply Reply Quote 1
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.