Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Copy Firewall Rules from a Interface to another.

    Scheduled Pinned Locked Moved General pfSense Questions
    12 Posts 4 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      ramses.sevilla
      last edited by

      Hi everyone.

      I have a Firewall with 50 Firewall Rules over LAN Interface.

      I have needed create two VLAN Interfaces and I would like know i there is any way to copy all Firewall Rules from LAN Interface to the new interfaces.

      I know that one to one I can but would be very heavy.

      Do you know if there is any other way?

      Best regards

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        There's no way to that via the gui since you can't edit more than one rule at a time.

        You could do it by editing the config directly and judicious use of find+replace. Easy to make a mistake doing that of course so make sure you can recover if the uploaded config causes a problem.

        Steve

        R 1 Reply Last reply Reply Quote 0
        • R
          ramses.sevilla @stephenw10
          last edited by

          @stephenw10 , thanks so much by your answer.

          Well, but I have some doubts.

          By example:

          I have this Firewall Rule over LAN Interface:

          <rule>
          	<id/>
          	<tracker>1579262139</tracker>
          	<type>pass</type>
          	<interface>lan</interface>
          	<ipprotocol>inet</ipprotocol>
          	<tag/>
          	<tagged/>
          	<max/>
          	<max-src-nodes/>
          	<max-src-conn/>
          	<max-src-states/>
          	<statetimeout/>
          	<statetype>keep state</statetype>
          	<os/>
          	<protocol>tcp/udp</protocol>
          	<source>
          		<any/>
          	</source>
          	<destination>
          		<address>Private_Networks_RFC1918</address>
          		<port>Internal_Ports_Allowed</port>
          	</destination>
          	<descr><![CDATA[Bypassing Policy]]></descr>
          	<created>
          		<time>1579262139</time>
          		<username>user@10.55.0.250</username>
          	</created>
          	<updated>
          		<time>1580385787</time>
          		<username>user@10.55.0.250</username>
          	</updated>
          </rule>
          

          And I want to copy it to Interface VLAN50 (opt5).

          Do I just need to copy / paste the previous rule in de config file and only change "<interface>lan</interface>" by "<interface>opt5</interface>" or need to modiffy the "<tracker>", "<created>" and "<updated>" fields?

          Best regards,

          Ramsés

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            You don't need created or updated tags but you do need tracker tags with a unique static ID to match rules to logs. Which is why the created timestamp is used. It could be anything though as long as it doesn't clash with the base rule tracker IDs:
            https://github.com/pfsense/pfsense/blob/master/src/etc/inc/filter.inc#L104

            Steve

            1 Reply Last reply Reply Quote 0
            • NogBadTheBadN
              NogBadTheBad
              last edited by NogBadTheBad

              Couldn't you create an interface group then move the rules from the LAN interface to the interface group that contains the LAN & OPT1 interface ?

              https://docs.netgate.com/pfsense/en/latest/interfaces/interface-groups.html

              Andy

              1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

              R 1 Reply Last reply Reply Quote 1
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Hmm, not sure I've ever tried that. But now I have; yes you could do that.

                The rules are all the same for every interface though so you can't use LANnet etc.

                Steve

                1 Reply Last reply Reply Quote 0
                • chpalmerC
                  chpalmer
                  last edited by chpalmer

                  You can just go to the rule.. create a copy and then edit the interface line and source address if needed.. When you save the rule it will show up in the correct place. 50 is a few to do but its pretty fool proof.

                  Triggering snowflakes one by one..
                  Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                  R 1 Reply Last reply Reply Quote 0
                  • R
                    ramses.sevilla @chpalmer
                    last edited by

                    @chpalmer , thanks so much by your answer.

                    I need to copy about 50 Firewall Rules to 10 new Interfaces (VLAN) and modify later.

                    If I copy the rules one to one...

                    I need a method to copy multiples rules to one time.

                    Best regards,

                    Ramsés

                    1 Reply Last reply Reply Quote 0
                    • R
                      ramses.sevilla @NogBadTheBad
                      last edited by

                      @NogBadTheBad , thanks so much by your answer.

                      But I need personalize some rules later. If I create a Group Interface I can't do this because the rules are applied to all Interfaces in the group.

                      Another thing, can I create a Group Interface and apply Rules to the Group and the individual Interfaces that are included in the group?

                      If yes, wich rules predominate, he group rules or the individual rules of each interface in the group?

                      Anyway, thanks by the idea.

                      Best regards,

                      Ramsés

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Rules on an interface group are parsed first. So anything matched by a rule there would never see rules on individual interfaces.
                        Floating rules are parsed before the group rules so it would be possible to add individual rules there but reading the ruleset would become...... difficult! 😉

                        https://docs.netgate.com/pfsense/en/latest/firewall/firewall-rule-processing-order.html

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • R
                          ramses.sevilla
                          last edited by

                          @stephenw10 / @NogBadTheBad, thanks so much by your answers.

                          I have a pfSense in production and I have a new doubt:

                          If I create a Interface Group is the traffic disrupted un any moment?

                          Best regards,

                          Ramses

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Simply creating the group will not do anything beyond giving you a new tab in Firewall > Rules.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.