Creating firewall rule via ssh

[speatzle_]

Hi, i have been trying to create firewall rules remotely via ssh.
So what i have been doing is:

• Connect via ssh and read the /conf/config.xml with cat
• Add a new rule to the filter section like this:

<rule>
            <type>pass</type>
            <ipprotocol>ipnet</ipprotocol>
            <descr>remote ssh test description</descr>
            <interface>lan</interface>
            <tracker>1591784472</tracker>
            <source>
                <network>lan</network>
            </source>
            <destination>
                <any/>
            </destination>
        </rule>

• Upload and Overwrite the current /conf/config.xml file
• Delete the /tmp/config.cache file
• Reload the config using /etc/rc.filter_configure or /etc/rc.reload_all
  This seems to work

For the tracker i have been using the current unix time but i have noticed that autogenerated / special rules have special values there. Are there ranges specified somewhere for these special rules?

Also what is the id element in rules for? It is only there for some rules and the it is also empty
And can i add custom elements and or attributes to rules without them being removed?

[skogs]

While this is a fine question, this is not the forum for it. This is the development forum for identifying and first stage troubleshooting new versions of pfsense before they are released.

Perhaps you should post in:
https://forum.netgate.com/category/4/firewalling

I'm afraid I test a lot of things, but manually making a rule via text editor is not one of them. ^^ probably better luck on the actual firewall section of the forum.

[jimp]

@skogs said in Creating firewall rule via ssh:

While this is a fine question, this is not the forum for it. This is the development forum for identifying and first stage troubleshooting new versions of pfsense before they are released.

It actually is the right place. It's not a question about firewalling, but about programming. Which is a form of development.

[serbus]

Hello!

While I haven't had the need to play with it yet, the interface documented here look pretty cool :

https://docs.netgate.com/pfsense/en/latest/development/using-the-php-pfsense-shell.html

Maybe you could use it to create rules in the config.

John

[jimp]

There are existing examples in the code for doing this as well. Start here:

https://github.com/pfsense/pfsense/blob/master/src/usr/local/bin/easyrule
https://github.com/pfsense/pfsense/blob/master/src/etc/inc/easyrule.inc