Filter rules not working
-
I have two SG-3100 appliance and one PC running the 2.4 version and filter rules doesn't apply properly. No matter what rules applied, everything is denied because of the Default deny rule. Filter reload an reset states doesn't fix it. After rebooting, rules apply fine. Anyone with the same issue? Some post related to this? Thanks!
-
Without you posting rules it impossible to help you.. You do not need to reboot to apply rules. The rules just need to be reloaded, which will happen when you apply.
Keep in mind that any states that exist will have to be killed or wait for them to time out, etc..
Please post your example of what your rules are, and then what you change them to and then what doesn't work.
-
You're right. I applied this NAT rule:
With associated filter rule automatic. After apply changes, reload filter, etc., the Default deny rule still were blocking traffic:
Finally, after reboot the appliance, the rule applied correctly. I had the same issue on two other 2.4 installations, so i suppose that maybe i'm missed some bug related to this version. My procedure is always the same regarding to add new filter rules. No issues in previous versions. Let me know if you need any other information.
-
2.4 You mean 2.4.4 - why would you not be running current?
And I ran 2.4 and sorry no that is not the case.. What rules do you have on your wan? The rule that allows the traffic needs be above rules that block.
You see the rules reload in your log? Are you running pfblocker or something that auto arranges rules?
What your saying is not possible if your rules are loading correctly and in the correct order.. The only thing that would cause what your saying is the rules not actually reloading... Which you can verify happens in the logs.
You can also go to status filter reload to reload your filters.
-
Johnpoz, thank you for your time. No WAN rules blocking traffic, just the associated ones that the NAT generated. The rules are printed in the filter reload status. I'm running 2.4.3 on that appliances, so i have to plan the 2.4.4 upgrade and check again. I'll back with news after that. We'll see.
