Question on Firewall Schedules in pfSense 2.3.2

rjr162

I'm trying to create a schedule to setup an ALLOW rule for a period of time so I can control when my kid is watching TV (since all of our services are streaming).

The docs here https://doc.pfsense.org/index.php/Firewall_Rule_Schedules state:

"Firewall rules can be scheduled so that they are only active at certain times of day or on certain specific days or days of the week."

When I try to create a schedule in pfSense, I'm entering my start time and end time, and give it a description, but it won't allow me to add the schedule without adding at least one date. Thing is, I want to to be an on-going rule.. I don't want this for one specific date on the calendar, nor do I want to have to manually click every date from now until August 2017.

With the way the doc is written, and with the way one would expect scheduling to work, this seems like a bug. Can anyone confirm if this is a bug, or if there is a way to "wild card" the date so it's an on-going deal?

Thanks!

– Ron

Derelict

Click individual date to select that date only. Click the appropriate weekday Header to select all occurrences of that weekday.

So if you want the same thing to fire every day, select all weekdays using the weekday headers (Sun, Mon, Tue, etc). Only on Mondays, select only Monday.

KOM

IIRC with the older config, it didn't work if you left it open but had some block rules – the states would remain open and not cleared. Instead, you had to block everything and then create rules when to allow access. I wonder if it still behaves this backwards way.

thecableguy

It doesn't seem to work… I am having the same issue with states remaining after the scheduled PASS expires.

I have UpNP off, block rule above pass rule in the LAN tab..

I have been using PF for years but it seems the last release or two, something has changed or broken the way states are cleared when the schedule changes?

:o

KOM

No idea. I don't use scheduling at all, but I remember the way you had to do it wasn't intuitive unless you understood what was going on behind the scenes.

thecableguy

Something is broken on the last release.. I have removed the pass rules in the LAN tab and both aliases can still access all blocked services.

Manually clearing states works initially however, the states re-establish after a few mins..

Derelict

Unpossible. Every time I lab this when someone says it doesn't work it works just fine.

If there is not a matching pass rule on LAN traffic will be blocked.

thecableguy

Thanks for the reply but this is the case.. Something must have gone wrong with the last update..

Looks like a re-install :'(

Derelict

Doubtful. But a reinstall takes 5 minutes + packages so if you think that might be the case, it can't hurt.

thecableguy

Thanks, reinstall tonight and report.

thecableguy

I thought i would try an older config backup before reinstalling PF from scratch.

It looks like everything is working again… Scheduled blocks are fine and firewall log entries are as expected.

Previously, no LAN blocks were working and nothing was showing in the firewall logs.. Not sure what went wrong but the older config reload fixed my issues for now.

Would be nice to know what went wrong? :o

thecableguy

Ok, problem back again.. The only thing I can point to is after modifying the schedules the scheduled 'pass' rule does not seem to work. After I manually clear states, the links are broken and the schedule shows the correct status in the 'pass' rule but after another cycle, the scheduled 'pass' doesn't kill states.

thecableguy

No one has a similar issue or any suggestions?

n3by

Looks like this is an old/unsolved problem…

To solve it you can add a cron job to clear all states for that IP ( or more IP's ) after time schedule is not active with this command:

/sbin/pfctl -k IP
example:
/sbin/pfctl -k 192.168.103.100

Just remember:

first rule will allow to pass traffic on time schedule for that IP.
second rule will deny traffic for that IP.
cron will clear all states for that IP ( 1 minute after first rule is not active ).

thecableguy

Yes, seems to be an ongoing issue..

After a reboot, everything works fine for a week or so and then the states don't clear properly..

thecableguy

I am still having this issue. . I have narrowed it down to when I make a change to a schedule this problem occurs.

I have tried resetting states and reloading the firewall rules after the schedule change but after the timed block/pass, some states remain active and require a manual clearing of states.

As long astory the schedules are not altered, everything works as expected..

I shouldn't have to reboot after a schedule change?

KOM

I should hope not. If this is something you can reproduce faithfully, you could post your steps here for others to confirm, and then enter a bug at Redmine to address it.

thecableguy

Could you please have a look at my rules?

I have blocked out the kids names but what I have are all IP's setup in aliases, a bandwidth limiter and different schedules for blocking steam ports (alias again) and to completely block internet using PASS rules in the schedule.

![lan rules.JPG_thumb](/public/imported_attachments/1/lan rules.JPG_thumb)
![lan rules.JPG](/public/imported_attachments/1/lan rules.JPG)

Derelict

Are you sure the Steam ports being blocked should be source ports? Source ports are usually random to specific destination ports.

thecableguy

Good question, my understanding is the 'source' in this situation would be the host on the LAN, as per the rule?

The block works if applied manually and also most of the time however as I mentioned, if I modify a schedule, reload the firewall rules and reset states the scheduled block stops working and requires a reboot of the firewall..