Question on Firewall Schedules in pfSense 2.3.2
-
Yes, seems to be an ongoing issue..
After a reboot, everything works fine for a week or so and then the states don't clear properly..
-
I am still having this issue. . I have narrowed it down to when I make a change to a schedule this problem occurs.
I have tried resetting states and reloading the firewall rules after the schedule change but after the timed block/pass, some states remain active and require a manual clearing of states.
As long astory the schedules are not altered, everything works as expected..
I shouldn't have to reboot after a schedule change?
-
I should hope not. If this is something you can reproduce faithfully, you could post your steps here for others to confirm, and then enter a bug at Redmine to address it.
-
Could you please have a look at my rules?
I have blocked out the kids names but what I have are all IP's setup in aliases, a bandwidth limiter and different schedules for blocking steam ports (alias again) and to completely block internet using PASS rules in the schedule.
 -
Are you sure the Steam ports being blocked should be source ports? Source ports are usually random to specific destination ports.
-
Good question, my understanding is the 'source' in this situation would be the host on the LAN, as per the rule?
The block works if applied manually and also most of the time however as I mentioned, if I modify a schedule, reload the firewall rules and reset states the scheduled block stops working and requires a reboot of the firewall..
-
Source ports are almost always random. Destination ports are almost always static.
For instance to pass connections only to HTTP servers you would pass source LAN net port any dest any port 80 on the LAN interface.
-
So you are suggesting to change the port alias to destination? Like the utorrent rule I have setup in the picture?
-
I am suggesting you make sure your rules match the traffic you are trying to match.
-
I am suggesting you make sure your rules match the traffic you are trying to match.
I tried swapping my rules around as you seemed to suggest :-\ and nothing is blocked/filtered after changing to 'destination' in the LAN tab..
Again, my configuration does work fine except when the schedules are changed.. A reboot is required to get the new schedule to work correctly.
-
Yeah I doubt that it works with source ports..
Quick google shows these as the ports.
Steam Client
UDP 27000 to 27015 inclusive (Game client traffic)
UDP 27015 to 27030 inclusive (Typically Matchmaking and HLTV)
UDP 27031 and 27036 (incoming, for In-Home Streaming)
TCP 27036 and 27037 (incoming, for In-Home Streaming)
UDP 4380.As Derelict mentions it is almost ALWAYS any for source port, dest would be the port your looking at in firewall rules. Unless your talking say active ftp session for data where the source port is 20. Or maybe in a dns zone transfer where your talking 53 to 53, etc. The cases where you would set a specific source port are few and specific. Steam would NOT be one of them.
So not sure what you think is working.. But that rule would not work.. What do you have in your steam alias??
If your saying your schedules do not work until you reboot, my guess would be you have active states open for the traffic your trying to block and your reboot flushes them. Which you can do without a reboot.
-
Yeah I doubt that it works with source ports..
Quick google shows these as the ports.
Steam Client
UDP 27000 to 27015 inclusive (Game client traffic)
UDP 27015 to 27030 inclusive (Typically Matchmaking and HLTV)
UDP 27031 and 27036 (incoming, for In-Home Streaming)
TCP 27036 and 27037 (incoming, for In-Home Streaming)
UDP 4380.As Derelict mentions it is almost ALWAYS any for source port, dest would be the port your looking at in firewall rules. Unless your talking say active ftp session for data where the source port is 20. Or maybe in a dns zone transfer where your talking 53 to 53, etc. The cases where you would set a specific source port are few and specific. Steam would NOT be one of them.
So not sure what you think is working.. But that rule would not work.. What do you have in your steam alias??
If your saying your schedules do not work until you reboot, my guess would be you have active states open for the traffic your trying to block and your reboot flushes them. Which you can do without a reboot.
It does work, lastnight it worked as expected..
-
Those rules are almost certainly wrong. Based on the information available on the steam site they are wrong.
Steam might try to use those as source ports which would cause them to pass and might try different source ports when they are blocked and fail to match the proper rules.
Look at Diagnostics > States and enable logging on those rules to see what's really happening.
You can create a pass rule from the source machines AFTER that block steam rule and enable logging on it to see what's getting passed.
-
Those rules are almost certainly wrong. Based on the information available on the steam site they are wrong.
Steam might try to use those as source ports which would cause them to pass and might try different source ports when they are blocked and fail to match the proper rules.
Look at Diagnostics > States and enable logging on those rules to see what's really happening.
You can create a pass rule from the source machines AFTER that block steam rule and enable logging on it to see what's getting passed.
The rules or aliases are wrong?
If they are wrong, why are they working until I alter the schedule?
-
Impossible to answer without seeing the actual states and firewall logs.
Your alias looks fine, though I would make a TCP alias and rule and a UDP alias and rule.
-
Impossible to answer without seeing the actual states and firewall logs.
Your alias looks fine, though I would make a TCP alias and rule and a UDP alias and rule.
So I need to create seperate TCP and UDP rules even though the firewall rule has an option for TCP/UDP for a particular rule?
-
There is no reason to pass UDP-only ports as TCP as well.
-
There is no reason to pass UDP-only ports as TCP as well.
So, it doesn't matter for what I am trying to work out then… only for security, which I understand.
Have you read the complete thread?
-
Yes. You exhibit a fundamental misunderstanding of how firewall rules work, the ports you are trying to control, and generally dismiss anyone who tries to correct you.
-
Yes. You exhibit a fundamental misunderstanding of how firewall rules work, the ports you are trying to control, and generally dismiss anyone who tries to correct you.
Wow, anyone else have anything constructive to add?
