Firewall Rules Processed Once Per Interface?
-
I feel like this is a super simple question, but I haven't been able to confirm or deny whether it works like this…
If a given packet comes in on the WAN and is intended for a destination on the LAN, will it get evaluated by the WAN rules and (if the WAN rules pass it) by the LAN rules? It makes sense that it would, but I wanted to double-check.
-
Yes pretty much and once per interface is also once per direction. Every packet that either enters or leaves via an interface is subject to filtering by the whole active ruleset (the ruleset you get by running pfctl -sr on the command line, forget the WebGUI representation of the rules). A packet entering from WAN and is going to the LAN network is first filtered on the WAN interface by the entire ruleset and matching rules apply, then the packet leaving via the LAN interface is again filtered using the whole ruleset and matching rules apply again.
-
No.. rules are only evaluated as they enter interface, not as they leave an interface.
Rules are evaluated top down, first rule to trigger wins, no other rules are evaluated.
If you need rules to be evaluated as they exit an interface, you can use the floating tab to create such rules - but these would only be required in the most complex configurations and should really never be needed.
https://doc.pfsense.org/index.php/Firewall_Rule_Processing_Order
-
@kpa:
Yes pretty much and once per interface is also once per direction. Every packet that either enters or leaves via an interface is subject to filtering by the whole active ruleset (the ruleset you get by running pfctl -sr on the command line, forget the WebGUI representation of the rules). A packet entering from WAN and is going to the LAN network is first filtered on the WAN interface by the entire ruleset and matching rules apply, then the packet leaving via the LAN interface is again filtered using the whole ruleset and matching rules apply again.
If that were true then pfSense would not be usable in its default form. Think of the fact that the WAN interface comes without rules but will still pass traffic initiated by the LAN interface. :)
-
So no basic understanding of states then I take it ;)
Your answer from what the lan requested is allowed back in because the outbound connection allowed by the lan rule creates a state, the server you talked to on the internet is allowed back in because of the state.
-
@kpa:
Yes pretty much and once per interface is also once per direction. Every packet that either enters or leaves via an interface is subject to filtering by the whole active ruleset (the ruleset you get by running pfctl -sr on the command line, forget the WebGUI representation of the rules). A packet entering from WAN and is going to the LAN network is first filtered on the WAN interface by the entire ruleset and matching rules apply, then the packet leaving via the LAN interface is again filtered using the whole ruleset and matching rules apply again.
If that were true then pfSense would not be usable in its default form. Think of the fact that the WAN interface comes without rules but will still pass traffic initiated by the LAN interface. :)
Well I left out the state mechanism on purpose because it's a minor complication that just adds "dynamic rules" that are just rules like all the others for filtering purposes.
-
Minor complication?
How can you leave out states when talking about a stateful firewall? Which is what pfsense is.. There has not be nonstateful firewall YEARS! Even the your cheap 20$ soho router is stateful..
If you were non stateful the only way you could work would be if your wan was really Any Any.. And how exactly would you be doing the napt without states?
-
That's not what I mean. If you look at what PF does at the bottom level the state comparison and filter rules aren't that different, packets are compared against rules or states and the comparisons are based on the exact same information. The only clever part is the state creation in case a filter rule is marked as a state creating one.
