Temporary allowed connections

HansSolo

@chpalmer said in Temporary allowed connections:

@HansSolo said in Temporary allowed connections:

You mean to tell me you, as a firewall expert, don't see the need for this? Seriously?

Very rarely if ever.. I would not spend a second of anyone else's time to design this into a product. It's to easy just to turn off the rule when its no longer needed.

Huh?
It's easier to go in and do three or four steps instead of ONE ? And then, remember to go back later and do three or four more?? Since when?

chpalmer

Just called my Watchguard rep and he thinks that your incorrect. He is going to check though.

One big issue I see is that just because you end a rule in a stateful firewall does not mean your connection to that destination is going to cease. You need to look at your states in any questionable situation and kill the state if it remains open. So something "automagically" happening is bad practice.

HansSolo

Your Watchguard rep is incorrect.
Place your bets now.

I'm being slowed down in responses to your questions due to 120 second rule. Can that get lifted please so I can answer?

johnpoz

Yeah let me click the temp allow user x to flood the board for 15 minutes button... Wait that is not there - what the F!!! Every other forum software on the planet has that ;)

I am betting on the rep ;)

HansSolo

@johnpoz said in Temporary allowed connections:

Yeah let me click the temp allow user x to flood the board for 15 minutes button... Wait that is not there - what the F!!! Every other forum software on the planet has that ;)

DON'T GET PASSIVE-AGGRESSIVE WITH ME DUDE !! lol

I thought it could be on a per user basis.

HansSolo

Seriously,
Not everyone who uses pfsense is in an Enterprise environment. I doubt most are.
I know that your revenue comes mostly from that tho so I can somewhat understand not including features that might not be needed outside an Enterprise enviro.

johnpoz

Again in what world do you live in that such feature would make sense ;) Just like click on blocked rule.. But allow thing for 15 minutes thing has zero use in the enterprise... But watchguard has it?

I think maybe there is something to allow access via their proxy rules, not their firewall rules. You understand the watchguards do proxy as well as just L3 firewall rules.

chpalmer

@HansSolo said in Temporary allowed connections:

Your Watchguard rep is incorrect.

He has sold more firewalls than he can remember and this question has never come up. If it is there then nobody is talking to him about it. I asked him as if I was looking and he says "why?" LOL

chpalmer

@johnpoz said in Temporary allowed connections:

But watchguard has it?

I don't personally consider Watchguard enterprise grade myself.

kiokoman

sadly 120 sec it's the minimum to digest bullshit sorry but this time i can't stop laughing

KOM

Alright, this is getting stupid now. The feature doesn't exist in pfSense and he has the only workaround. The end.

johnpoz

@chpalmer very true... I have never seen it used in any enterprise we have ever supported..

In a mom and pop shop, you click the eazy rule... And then 15 min later or 1 hour later you delete the rule... How freaking hard is that?? I mean really?

HansSolo

@kiokoman said in Temporary allowed connections:

sadly 120 sec it's the minimum to digest bullshit sorry but this time i can't stop laughing

Are you saying it's normally incoming or outgoing ?
You only needed 10 seconds to share yours

HansSolo

@johnpoz said in Temporary allowed connections:

@chpalmer very true... I have never seen it used in any enterprise we have ever supported..

In a mom and pop shop, you click the eazy rule... And then 15 min later or 1 hour later you delete the rule... How freaking hard is that?? I mean really?

Suture yourself.
Some other software firewall (opensense) WILL include it and then they'll have just one more reason not to use pfsense.
Juuuuuuust sayin.

Not everyone who uses pfsense in necessarily is an environment that pure enterprise. I got no dog in this fight. Just pointing something out. You guys are Sooooooo sensitive to suggestions. lol

johnpoz

Yeah they will be leaving in droves flocking to that feature that zero people need ;)

Still waiting for the screenshot where you do this in watchguard, which you said it does... I placed my bet on the rep that says it doesn't..

You are more than welcome to code that up since its so easy, and submit the PR...

HansSolo

@johnpoz said in Temporary allowed connections:

Yeah they will be leaving in droves flocking to that feature that zero people need ;)

Still waiting for the screenshot where you do this in watchguard, which you said it does... I placed my bet on the rep that says it doesn't..

when KOM's rep gets back and says it does...be man enough to admit it ok?

chpalmer

@HansSolo said in Temporary allowed connections:

If not, that's very disappointing.

I believe it started when you scolded the product like a young child..

johnpoz

If they do allow it - it sure not in their create policy documentation that is for sure ;) Why should we have to wait for his rep? You are sure they do it - so you don't have access to a watchguard that you can take a screenshot showing it?

HansSolo

@chpalmer said in Temporary allowed connections:

@HansSolo said in Temporary allowed connections:

If not, that's very disappointing.

I believe it started when you scolded the product like a young child..

Seriously?
"Scolded the product" ? LMAO.
That's what consumers do mate !!
Imagine if every company folded because they got "scolded" HAHAHAHAHA !!!!

You guys need a tougher hide.

KOM

@HansSolo said in Temporary allowed connections:

Suture yourself

/r/boneappletea

I must admit that I am impressed with how quickly you can manage to piss off senior members here. Frankly, nobody really cares if Watchguard has that feature or not since it's moot. pfSense doesn't have it, so if that feature is critical to you then I guess you will be using a Watchguard and have no more need of pfSense.