Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] Curious Floating Rules Behavior

    Scheduled Pinned Locked Moved Firewalling
    45 Posts 5 Posters 6.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      Kryptos1
      last edited by

      @Derelict:

      The reason the packets are dropped in the first two examples is because your floating rule catches the traffic (actually the state creation) as it leaves the LAN interface OUTBOUND.

      Cannot possibly be correct because the packet didnt "leave" the LAN at all - that was the whole point of the test. They "left" the OPT1 and matched the floating rule because it was OUTside relative to the interface.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Of course they didn't leave LAN. They were blocked by the firewall so the state was never created.

        Let's get some terminology clear:

        inside/outside

        LAN/Trusted –- inside --- FIREWALL --- outside --- Internet/Untrusted

        inbound (ingress) / outbound (egress)

        inbound  --->|
                    | Interface
        outbound <--

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • K
          Kryptos1
          last edited by

          @Derelict:

          Of course they didn't leave LAN. They were blocked by the firewall so the state was never created.

          Let's get some terminology clear:

          inside/outside

          LAN/Trusted –- inside --- FIREWALL --- outside --- Internet/Untrusted

          inbound (ingress) / outbound (egress)

          inbound  --->|
                      | Interface
          outbound <--

          The drawing posted by johnpoz is spot on. However, it seems you guys both believe that "OUT" means "OUTbound" (or egress). "OUT" is the direction of packets relative to the interface, its is not "egress" at all.. So in my case, packets sent from the raspberry pi were OUTside relative to the LAN.

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            OUTSIDE is a location
            OUTBOUND is a direction

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • K
              Kryptos1
              last edited by

              @Derelict:

              OUTSIDE is a location
              OUTBOUND is a direction

              Whatever the case, "OUT" is neither egress traffic nor is it "OUTbound" traffic. It is traffic that is relative to the interface thats been selected.  I agree with johnpoz's drawing 100%.

              Home_Lab2.jpg
              Home_Lab2.jpg_thumb

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Exactly. You seem to confuse ingress/egress with inside/outside. That is only true when you are talking about the WAN interfaces.

                Traffic from LAN hosts INGRESSES the firewall on its way INBOUND into the LAN interface. Reply traffic for those connections EGRESSES the LAN interface on its way back OUTBOUND to the LAN hosts - relative to the LAN interface.

                The only problem here is your failure to properly comprehend these terms in English as they relate to common usage when describing firewall behavior.

                There is nothing at all curious about the floating rule behavior you have described.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • K
                  Kryptos1
                  last edited by

                  @Derelict:

                  Exactly. You seem to confuse ingress/egress with inside/outside. That is only true when you are talking about the WAN interfaces.

                  The drawings and tests I performed are 100% on. The confusion regarding IN,OUT,ANY direction is because of people citing it OUT as OUTbound/egress traffic when it is not.

                  @Derelict:

                  Traffic from LAN hosts INGRESSES the firewall on its way INBOUND into the LAN interface.

                  Agree 100%

                  @Derelict:

                  Reply traffic for those connections EGRESSES the LAN interface on its way back OUTBOUND to the LAN hosts - relative to the LAN interface.

                  Test # 2 was the complete opposite and while I agree with your use of terms, the 'EGRESS" traffic you're referring to has nothing to do with the OUT direction.

                  @Derelict:

                  The only problem here is your failure to properly comprehend these terms in English as they relate to common usage when describing firewall behavior.

                  This is as backwards as the terms being discussed.  EGRESS has nothing to do with OUT under floating rules.

                  @Derelict:

                  There is nothing at all curious about the floating rule behavior you have described.

                  I didn't…

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    The drawings and tests I performed are 100% on. The confusion regarding IN,OUT,ANY direction is because of people citing it OUT as OUTbound/egress traffic when it is not.

                    Yes it is, relative to the interface. That is why you select an INTERFACE and a DIRECTION RELATIVE TO THAT INTERFACE.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • K
                      Kryptos1
                      last edited by

                      @Derelict:

                      The drawings and tests I performed are 100% on. The confusion regarding IN,OUT,ANY direction is because of people citing it OUT as OUTbound/egress traffic when it is not.

                      Yes it is, relative to the interface. That is why you select an INTERFACE and a DIRECTION RELATIVE TO THAT INTERFACE.

                      OUT is not "egress/outbound" traffic. Think about what you're saying above. If you agree with me that that OUT,IN,ANY are DIRECTION(s) RELATIVE TO an INTERFACE selected, then you cannot possibly say that "OUT" is egress or outbound without contradicting yourself. "OUT" is not outbound traffic

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        I am done. Someone else's turn.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 1
                        • K
                          Kryptos1
                          last edited by

                          @Derelict:

                          I am done. Someone else's turn.

                          I think you have finally seen the difference and might be too proud to admit it. Don't beat yourself up because I confused "OUT" as being associated with OUTbound/egress for years until I finally sat down and went through those tests I posted. I see you and johnpoz have many postings in these forums and its great to have people actively helping one another. Don't get flustered. And dont be too proud to admit you might have learned something new in this discussion.

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Sigh.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • K
                              Kryptos1
                              last edited by

                              @Derelict:

                              Sigh.

                              ditto

                              1 Reply Last reply Reply Quote 0
                              • K
                                Kryptos1
                                last edited by

                                @Derelict:

                                Sigh.

                                Lots of people have holes in their firewall configs for the very reasons being discussed here."OUT" is the direction of packets relative to the interface.

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  Now you seem to be equating "egress" with "traveling from the inside to the outside. From the trusted to the untrusted. From the LAN to the WAN/Internet."

                                  That is not it at all. "ingress" is "INto an interface." WAN or LAN, inside or outside, doesn't matter. It is traffic received by an interface coming into (aka ingressing) the firewall.

                                  "egress" is "OUT of an interface." WAN or LAN, inside or outside, doesn't matter. It is traffic transmitted by an interface going out of (aka eggressing) the firewall.

                                  Look at this again - Really, honestly look at it:

                                  inside/outside

                                  LAN/Trusted –- inside --- FIREWALL --- outside --- Internet/Untrusted

                                  inbound (ingress) / outbound (egress)

                                  inbound  --->|
                                              | Interface
                                  outbound <--

                                  You insist on using nonstandard terms. I have been trying to get on the same terminology for several posts.

                                  No, I don't need your money. I know I am correct. Use it to buy a dictionary.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • K
                                    Kryptos1
                                    last edited by

                                    @Derelict:

                                    "egress" is "OUT of an interface." WAN or LAN, inside or outside, doesn't matter. It is traffic transmitted by an interface going out of (aka eggressing) the firewall.

                                    So long as you don't associate the above as having anything to do with the "OUT" direction under floating rules, then I agree. If you're saying that it does and that "OUT" is OUTbound/egress traffic then it's simply not correct. And this confusion keeps perpetuating on these forums because people are posting stuff they dont really understand.

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      That is exactly what it means in floating rules. That is exactly what your tests showed.

                                      Maybe I will take that $500. Let's make that 0.0625 bitcoin before you try to pay in zim dollars or something.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        Kryptos1
                                        last edited by

                                        @Derelict:

                                        That is exactly what it means in floating rules. That is exactly what your tests showed.

                                        Maybe I will take that $500.

                                        So just to be absolutely clear, if you're saying then that "OUT" in floating rules applies to egress/outbound traffic, then I'm all for doing a conference with you. My test #2 showed that OUT is NOT egress outbound traffic - it is the direction of traffic relative to the interface. So if you'r still up fo it citing "Maybe I will take that $500." lets arrange for a time this weekend or next.

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          See there you go again. Can you not read? We are both saying that OUT is RELATIVE TO THE INTERFACE. You keep bandying about this nonsense about "egress outbound traffic."

                                          Please define "egress outbound traffic" so everyone knows wtf you are talking about.

                                          There is a diagram in my signature. Use that as a reference when you describe it.

                                          It is per interface, nobody has ever said any different.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • K
                                            Kryptos1
                                            last edited by

                                            @Derelict:

                                            See there you go again. Can you not read? We are both saying that OUT is RELATIVE TO THE INTERFACE. You keep bandying about this nonsense about "egress outbound traffic."

                                            Please define "egress outbound traffic" so everyone knows wtf you are talking about.

                                            There is a diagram in my signature. Use that as a reference when you describe it.

                                            It is per interface, nobody has ever said any different.

                                            Gotta go to work, but Ill respond tonight/tomorrow. I feel like Bill Nye debating Ken Ham with comments like "Can you not read?".

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.