Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall Rules Order

    pfBlockerNG
    13
    34
    20.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Stewart
      last edited by

      Whenever I apply changes to pfBlockerNG it rearranges the firewall rules order and places the blocks above the pass on both the WAN and LAN configured ports.  Is there a way to change that?  It effectively makes the whitelist usesless for me and I have to go rearrange the rules each time.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Yeah use GeoIP type Alias Native. That will create the aliases but will not place any rules. You can then make the rules yourself and they will stay where you put them.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 1
        • RonpfSR
          RonpfS
          last edited by

          You can adjust the FW Rules ordering in Firewall / pfBlockerNG / IP ; IP Interface/Rules Configuration ; Firewall 'Auto' Rule Order

          2.4.5-RELEASE-p1 (amd64)
          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Right. If one of those options works for you on all interfaces.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • S
              Stewart
              last edited by

              @RonpfS:

              You can adjust the FW Rules ordering in Firewall / pfBlockerNG / IP ; IP Interface/Rules Configuration ; Firewall 'Auto' Rule Order

              Thanks.  I'll give it a shot.  Why isn't the default to allow the Pass above Block?  Does it just choose the first alphabetically from the list?

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Because if you Pass access from any to your web servers then block with pfBlocker, the block rules will not be hit.

                Everyone's requirements are different.

                I personally don't like the thought of a package manipulating my firewall rules.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator
                  last edited by

                  @Derelict:

                  Because if you Pass access from any to your web servers then block with pfBlocker, the block rules will not be hit.

                  Everyone's requirements are different.

                  I personally don't like the thought of a package manipulating my firewall rules.

                  Yes It's not a fit for all users. But most users tend to have simpler rules and the ordering options listed may work for them. Other options include adding the Permit rules to pfBNG so that some scenarios can work.

                  Otherwise, users can opt for "Alias type" rules, which will just create the Aliastable of IPs, and the user can make all of the rules as required… There is also a trick to use Auto Type rules which will create the Rules on all of the required interfaces. Then the user can manually edit each one and only change the Description to start with "pfb_" (Lowercase).  Then edit each Alias to use "Alias type" ... So it saves the user from having to manually create all the rules the first time...

                  Other options include using the Adv. In/Out rule settings to further customize the rules....

                  YMMV...

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Excellent. Thank you.

                    I was hoping for a way to get them all set up automatically then convert them to manual.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • S
                      Stewart
                      last edited by

                      @Derelict:

                      Because if you Pass access from any to your web servers then block with pfBlocker, the block rules will not be hit.

                      Everyone's requirements are different.

                      I can see that everyone's requirements are different.  It just seems odd that by default the package can create whitelists but doesn't apply them in a way that works.  Once you know it's an easy change but it seems inconsistent.

                      I personally don't like the thought of a package manipulating my firewall rules.

                      If you don't like packages manipulating your firewall rules then I would assume you don't use pfBlocker since that is how it functions?  Is there anything that you do instead that would mimic the features?

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        The package does do something meaningful for users. Just because it is not right for YOU doesn't mean it is broken.

                        Use type Alias Native, let pfBlocker manage the aliases and use them in rules as you see fit.

                        Read all of the above again, particularly the part about changing the rule description so pfBlocker stops messing about with them.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • S
                          Stewart
                          last edited by

                          @Derelict:

                          The package does do something meaningful for users. Just because it is not right for YOU doesn't mean it is broken.

                          Use type Alias Native, let pfBlocker manage the aliases and use them in rules as you see fit.

                          Read all of the above again, particularly the part about changing the rule description so pfBlocker stops messing about with them.

                          You misunderstand.  It's working after changing the rule order.  I'm just wondering why the default rule order is the one chosen as default.  I realize it isn't broken.  It just seems odd to me that the default order makes the white listing ineffective.  It seems to me that a different rule order would be better suited to be default.  I was just asking what the reason was for this particular order to be default.  I wasn't stating it was broken.  I was merely speculating a question.

                          1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator
                            last edited by

                            @Stewart:

                            @Derelict:

                            The package does do something meaningful for users. Just because it is not right for YOU doesn't mean it is broken.

                            Use type Alias Native, let pfBlocker manage the aliases and use them in rules as you see fit.

                            Read all of the above again, particularly the part about changing the rule description so pfBlocker stops messing about with them.

                            You misunderstand.  It's working after changing the rule order.  I'm just wondering why the default rule order is the one chosen as default.  I realize it isn't broken.  It just seems odd to me that the default order makes the white listing ineffective.  It seems to me that a different rule order would be better suited to be default.  I was just asking what the reason was for this particular order to be default.  I wasn't stating it was broken.  I was merely speculating a question.

                            YMMV… The default is what was the original setting from v1 of pfBlocker... so its never been changed...  I'll consider some changes to the code to possibly a notice message when a Permit rule is added to check the rule order settings....  No matter what is selected it will work if your case, but possibly affect other scenarios.... There are too many options to make an "easy button"....

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              @Derelict:

                              The package does do something meaningful for users. Just because it is not right for YOU doesn't mean it is broken.

                              Use type Alias Native, let pfBlocker manage the aliases and use them in rules as you see fit.

                              Read all of the above again, particularly the part about changing the rule description so pfBlocker stops messing about with them.

                              Also keep in mind that users can use other "Alias type" options, like "Alias Deny" which will do the same thing, but utilize deduplication/suppression etc…

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • chudakC
                                chudak
                                last edited by

                                @RonpfS:

                                You can adjust the FW Rules ordering in Firewall / pfBlockerNG / IP ; IP Interface/Rules Configuration ; Firewall 'Auto' Rule Order

                                The only problem is that there is no order option which would place pfSense pass and block rules above pfBlockerNG rules
                                pfBlockerNG rules always pushes "block" rules on the bottom and this seems like a problem.

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  You can always add the pfSense Blocked IPs to a pfBlockerNG customlist instead…. Then no need for a different Rule order option.... Plus these IPs will be deduplicated with the other IP Feeds in use...

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • chudakC
                                    chudak
                                    last edited by

                                    @BBcan177:

                                    You can always add the pfSense Blocked IPs to a pfBlockerNG customlist instead…. Then no need for a different Rule order option.... Plus these IPs will be deduplicated with the other IP Feeds in use...

                                    I guess I don't know how to make it happn and you can elaborate a bit.
                                    I have  rules like this =>  https://snag.gy/HceE21.jpg
                                    (One rule allow DNS to pfSense only and other block all non pfSense DNS quires)

                                    When pfBlockerNG updates or reloads and resorts rules it actually inserts  pfBlockerNG rules before pfSense block DNS rule.

                                    I tried all options, including using Floating Rules in pfBlockerNG and so far found no remedy (logged a feature request that I believe would help https://redmine.pfsense.org/issues/8279).

                                    So @BBcan177 pls elaborate.

                                    1 Reply Last reply Reply Quote 0
                                    • BBcan177B
                                      BBcan177 Moderator
                                      last edited by

                                      You can create a new alias in pfBlockerNG and add "0.0.0.0" which is equivalent to "any" IP, into the custom list…

                                      Then edit either the Advanced Inbound or Outbound Firewall rule settings to configure the balance of the rules options...

                                      You can then define this Alias Action setting to Permit or Block...

                                      You can drag the Aliases from the IP tab to re-order as you wish.

                                      Also as stated above, you can use "Alias Type" rules and create all the rules manually.

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • chudakC
                                        chudak
                                        last edited by

                                        @BBcan177:

                                        You can create a new alias in pfBlockerNG and add "0.0.0.0" which is equivalent to "any" IP, into the custom list…

                                        Then edit either the Advanced Inbound or Outbound Firewall rule settings to configure the balance of the rules options...

                                        You can then define this Alias Action setting to Permit or Block...

                                        You can drag the Aliases from the IP tab to re-order as you wish.

                                        Also as stated above, you can use "Alias Type" rules and create all the rules manually.

                                        Thank you!  But I have more questions then answers to those steps, need more info.

                                        It seems overall the rules order in combination with pfB has room for improvement  :D

                                        1 Reply Last reply Reply Quote 0
                                        • chudakC
                                          chudak
                                          last edited by

                                          @BBcan177:

                                          You can create a new alias in pfBlockerNG and add "0.0.0.0" which is equivalent to "any" IP, into the custom list…

                                          Then edit either the Advanced Inbound or Outbound Firewall rule settings to configure the balance of the rules options...

                                          You can then define this Alias Action setting to Permit or Block...

                                          You can drag the Aliases from the IP tab to re-order as you wish.

                                          Also as stated above, you can use "Alias Type" rules and create all the rules manually.

                                          I don't know but all those changes seem too much and too complicated.

                                          Here is my example, I want to keep untouched rules order to make all network clients to use pfSense router as DNS server like:

                                          pass - Allow DNS to pfSense only
                                          block - Block all DNS not to pfSense

                                          And every time pfBlockerNG updates, my "block" rule get pushed to the end of the list.

                                          It seems wrong to me regardless of workarounds.  As I described in this https://redmine.pfsense.org/issues/8279

                                          Why won't we either

                                          1 - in pfBlockerNG, Rule Order add option - "Do not change (preserve) existing order"

                                          or

                                          2 - in Firewall Rules <if>add say a check box "Preserve existing order", which will not allow the order to be changed.

                                          ???</if>

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            coffeecup25
                                            last edited by coffeecup25

                                            Floating rules are evaluated first - or at least they were a few years ago.

                                            I had to solve this problem a few years ago. Make the rules that get moved downward into floating rules. Then change the evaluation order of the others as needed using built in tools.

                                            I don't have this problem today but I'm sure the answer is still correct.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.