Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall Rule Numbers

    Scheduled Pinned Locked Moved Firewalling
    25 Posts 8 Posters 9.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • KOMK
      KOM
      last edited by

      In settings, enable the Filter descriptions

      Thank you!

      Hmm, after trying it, it would be much more helpful if it would make use of the descriptions that you attach to every rule.  All I get are the Default Deny and then just a list of numbers in brackets.

      fw.png
      fw.png_thumb

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned
        last edited by

        I somehow thought it was the default?! (Kept wondering why everyone keeps posting screenshots with those unreadble rule numbers.)

        1 Reply Last reply Reply Quote 0
        • H
          hulleyrob
          last edited by

          Yeah not every rule shows its description as i have them in column view but i still get rules that i would have to work out which rule caused it. If it just displayed the rule description for all rules in column or second row view it would be much better.

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by

            Perhaps post a screenshot? Does not happen here.

            1 Reply Last reply Reply Quote 0
            • N
              NOYB
              last edited by

              My firewall log shows both the rule description and rule number.  Only time I've know it to show just the rule number is for firewall rules that are disabled or deleted.

              1 Reply Last reply Reply Quote 0
              • C
                cmb
                last edited by

                The description is shown where one exists. If you have a number only, it should only be because it's being logged by a user-defined rule with a blank description. Or possibly the deleted rule scenario NOYB mentioned if you removed some rule(s).

                1 Reply Last reply Reply Quote 0
                • N
                  NOYB
                  last edited by

                  Just verified that a disabled (not deleted) firewall rule will also result in the description no longer being displayed in the firewall log.  Upon re-enabling the rule the description is again displayed in the firewall log.

                  2.2.3-RELEASE  (i386)
                  built on Tue Jun 23 16:37:33 CDT 2015

                  FreeBSD 10.1-RELEASE-p13

                  1 Reply Last reply Reply Quote 0
                  • D
                    doktornotor Banned
                    last edited by

                    Well yes, cannot get a description where it doesn't exist in the active ruleset. ;)

                    1 Reply Last reply Reply Quote 0
                    • H
                      hulleyrob
                      last edited by

                      Ok thanks I've toggled column view a few times and it all seems to work but they root of my problem seems to be just one rule that will not show a description. All the rules on the OPT1 interface have a description but i think i will just have to work it out manually which was what i was hoping to avoid.

                      Also at the command line running pfctl -vvsr give mess this relating to that number

                      @40(1000000114) block drop log quick inet proto tcp from any to any port = 0
                        [ Evaluations: 5321224  Packets: 4737      Bytes: 284220      States: 0    ]
                        [ Inserted: pid 73290 State Creations: 18446735277732176120]
                      @41(1000000114) block drop log quick inet proto udp from any to any port = 0
                        [ Evaluations: 5316129  Packets: 4737      Bytes: 284220      States: 0    ]
                        [ Inserted: pid 73290 State Creations: 18446735277732176096]

                      Although I'm no clearer where this rule has come from.

                      Thanks for replies.

                      ![Screen Shot 2015-07-18 at 09.44.52.jpg](/public/imported_attachments/1/Screen Shot 2015-07-18 at 09.44.52.jpg)
                      ![Screen Shot 2015-07-18 at 09.44.52.jpg_thumb](/public/imported_attachments/1/Screen Shot 2015-07-18 at 09.44.52.jpg_thumb)

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by

                        @hulleyrob:

                        Ok thanks I've toggled column view a few times and it all seems to work but they root of my problem seems to be just one rule that will not show a description. All the rules on the OPT1 interface have a description but i think i will just have to work it out manually which was what i was hoping to avoid.

                        Also at the command line running pfctl -vvsr give mess this relating to that number

                        @40(1000000114) block drop log quick inet proto tcp from any to any port = 0

                        Well that does not have any label, it's this stuff in https://github.com/pfsense/pfsense/blob/master/etc/inc/filter.inc#L3157

                        Try this with System Patches package:

                        
                        --- a/etc/inc/filter.inc
                        +++ b/etc/inc/filter.inc
                        @@ -2876,10 +2876,10 @@ pass in {$log['pass']} quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 i
                         pass in {$log['pass']} quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {128,133,134,135,136} tracker {$increment_tracker($tracker)} keep state
                        
                         # We use the mighty pf, we cannot be fooled.
                        -block {$log['block']} quick inet proto { tcp, udp } from any port = 0 to any tracker {$increment_tracker($tracker)}
                        -block {$log['block']} quick inet proto { tcp, udp } from any to any port = 0 tracker {$increment_tracker($tracker)}
                        -block {$log['block']} quick inet6 proto { tcp, udp } from any port = 0 to any tracker {$increment_tracker($tracker)}
                        -block {$log['block']} quick inet6 proto { tcp, udp } from any to any port = 0 tracker {$increment_tracker($tracker)}
                        +block {$log['block']} quick inet proto { tcp, udp } from any port = 0 to any tracker {$increment_tracker($tracker)} label "Block traffic from port 0"
                        +block {$log['block']} quick inet proto { tcp, udp } from any to any port = 0 tracker {$increment_tracker($tracker)} label "Block traffic to port 0"
                        +block {$log['block']} quick inet6 proto { tcp, udp } from any port = 0 to any tracker {$increment_tracker($tracker)} label "Block traffic from port 0"
                        +block {$log['block']} quick inet6 proto { tcp, udp } from any to any port = 0 tracker {$increment_tracker($tracker)} label "Block traffic to port 0"
                        
                         # Snort package
                         block {$log['block']} quick from <snort2c>to any tracker {$increment_tracker($tracker)} label "Block snort2c hosts"</snort2c> 
                        
                        1 Reply Last reply Reply Quote 0
                        • H
                          hulleyrob
                          last edited by

                          Not quite sure i want to do that yet but will just know that this particular rule number relates to the default rules and not worry about it anymore.

                          Thanks for all your help.

                          Regards

                          Rob

                          1 Reply Last reply Reply Quote 0
                          • D
                            doktornotor Banned
                            last edited by

                            It's been merged to 2.2.4.

                            1 Reply Last reply Reply Quote 0
                            • 2
                              2chemlud Banned
                              last edited by

                              Question slightly OT: Is it good practice NOT to log packages blocked by the default deny rule (Settings, first option under "Log Firewall Default Blocks"?

                              1 Reply Last reply Reply Quote 0
                              • D
                                doktornotor Banned
                                last edited by

                                Hmmm… depends on how much noise you like, or what you policies are, or whatever. Wouldn't say there's any "best practice" here.

                                1 Reply Last reply Reply Quote 0
                                • H
                                  hulleyrob
                                  last edited by

                                  Im still trying to work out the best settings since I've only been using pfsense a few months so I've left logging on most things so i can see whats going on unless i really really don't want to know about something.

                                  1 Reply Last reply Reply Quote 0
                                  • H
                                    hulleyrob
                                    last edited by

                                    I dont suppose you could do the same for UPnP rules as well?

                                    Thanks

                                    Rob

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      snore
                                      last edited by

                                      (This is an attempt by me to not clutter up this forum by repeating the same question, but instead information to an already existing thread if that is similar. If I did wrong by doing that I apologize).

                                      I have the same problem as the OT. I suddenly have blocks in my FW log without descriptions. Clicking on the red cross doesn't show any other information.

                                      (I do know this happens when you disable logging for a FW rule which was previously enabled, but I did not do such a thing at all).

                                      Is there a place where I can find all the rule numbers together?

                                      Log:

                                      pfs_fw_descriptions01.jpg

                                      Click red cross:

                                      pfs_fw_descriptions02.jpg

                                      Bonus: this description isn't right. MULLVAD is a separate interface, it is not the interface VLAN40:

                                      pfs_fw_descriptions03.jpg

                                      Thank you for help 🕺

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        cat /tmp/rules.debug Look at the tracker.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 1
                                        • S
                                          snore
                                          last edited by

                                          Thank you. I also discovered
                                          https://pfsense/status.php

                                          1 Reply Last reply Reply Quote 0
                                          • DerelictD
                                            Derelict LAYER 8 Netgate
                                            last edited by

                                            rules.debug is the best place to get the configured rule set all in one place. It is usually one of the first places I go when evaluating a status output, depending on what the trouble is.

                                            I never look at the rules in the config.xml. rules.debug lays them all out for you in a readable format.

                                            Chattanooga, Tennessee, USA
                                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.