Firewall: Scheduling block game console
-
Again, for pfctl -k for 3 out of 4 IPs at least one state (port 80 or 443) was still there one minute after block rule and cron job should have killed the internet connection. No idea what's wrong here…
Maybe the pfctl -k is started befor the block becomes effective, so in placed it not at 21:01... see how it works tomorrow.
-
Yeah, again – schedule allow rules and NOT the block ones. But for sure you can keep banding your head against the wall for a couple more months. Good luck.
-
When you schedule pass rules instead of block rules are associated states automatically purged when the rule is disabled or something?
If not I don't see the difference. He'd also need a block rule after the pass rule.
pass xbox scheduled
block xbox
pass everything elseInstead of:
block xbox scheduled
pass everything else -
When you schedule pass rules instead of block rules are associated states automatically purged when the rule is disabled or something?
If not I don't see the difference. He'd also need a block rule after the pass rule.Yeah, the difference it that when the default is to block, then you don't need to pray for the states to get purged. There are no states, the traffic is being blocked by default until allowed. It works. Really. Try it. Scheduled block rules don't.
He'd also need a block rule after the pass rule.
pass xbox scheduled
block xbox
pass everything elseInstead of:
block xbox scheduled
pass everything elseNo. He'd need
- pass xbox scheduled
- pass everything else but xbox
- (default block everything, no rule needed for this)
-
Ah. I'm not a fan of "pass/block all except x" rules.
I still don't see the difference.
If there are states when the block rule fires, those states are still there until cleared.
If there are states when the pass rule expires, those states are still there until cleared. -
I have only limited ports allowed, some for the whole local subnet(s), some for each specific client. No way to have that done with scheduled allow rules without a lot of trouble.
It is simply unprofessional to have scheduled block rules but not to care if they work.
My opinion.
-
They work fine. Like everywhere else, when you set a rule it doesn't affect existing states and they have to be cleared either organically or by force.
I had to set a schedule for one of my kids once. I just didn't sweat that everything didn't stop working exactly when the rule fired. Worked fine and accomplished its goal even if it was a little fuzzy on exactly when everything stopped working. All you really have to do is break DNS. That makes about everything useless.
-
eeeh, leaving kiddies half the night with some games, music channels or messengers that work on with existing states for every is not "they work fine" for me. Sorry.
-
So use cron and pfctl to kill the states.
-
No problem to me, as long as the -k worked properly, in the pre-2.2 era. But now I have to kill all states to make it really work. Dunno why. Always the states with
re1 tcp routerIP(localIP) -> remoteIP ESTABLISHED…
in the states tab survive the -k procedure.
That's not fair. :-(
-
Update: selective killing of states with option -k is broken, leaves a lot of states in place, as pointed out above. No way around kicking off all users by killing all their states.
