Reply-to exceptions question
-
Group interfaces, floating rules, anything grouping thing except for aliases is bound to exempt the rule from a reply-to tag on it. I got that painfully clear, but I'm curious what if it's a floating rule to the firewall itself?
Do these work? I mean...the firewall always knows about its directly connected interfaces/networks and even if it didn't, it could just send its responses back from where they came from, right?? That makes sense to me but I tend to be pretty wrong when I'm making these assumptions. What I imagine that could exempt it under my own premise is that a floating rule is some kind of funnel --because it takes from any interface-- and drops the traffic, condition-allowing, stripped of its origin.
Do floating to firewall work? I though I had done it before in a multihomed pfSense DHCP dedicated server but I later realized I had added rules on each interface as well and on top of that it was set as a routing platform; no filtering, no NAT. Rules may have not mattered at all.
-
The general thing to remember is if the rule covers multiple interfaces, you won't get reply-to.
Find your rule in
/tmp/rules.debugif you have questions about what is actually happening. -
@Derelict Thanks! I will set a lab to try that out, I had no idea about that location. I don't have such a rule right now, I was just curious. I did come across some routing problems in the last few days, that's what it took me so long to come back. Thanks!