• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Floating vs Interface rules processing order

Scheduled Pinned Locked Moved Firewalling
41 Posts 5 Posters 8.2k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • T
    turrican64 @chriva
    last edited by turrican64 Aug 19, 2019, 12:33 PM Aug 19, 2019, 12:11 PM

    @chriva

    From Derelict good explanation I can say the following

    Processing order:
    1.Floating Rules (Quick + NON Quick)
    2.Interface Group Rules (always Quick)
    3.Interface Rules (always Quick)

    However Quick flag reverses the behavior of “first match wins” to be “last match wins”.
    Therefore if there is another rule after the Quick rule which matches that will take effect not the Quick one.

    And as you say MATCH applied immediately and evaluation continues for the rest of the ruleset.

    C 1 Reply Last reply Aug 19, 2019, 2:17 PM Reply Quote 0
    • T
      turrican64
      last edited by turrican64 Aug 19, 2019, 12:29 PM Aug 19, 2019, 12:28 PM

      And statement from the pfsense book that:

      "Without Quick checked, the rule will only take effect if no other rules match the traffic"

      is not applicable to MATCH rules.

      1 Reply Last reply Reply Quote 0
      • C
        chriva @turrican64
        last edited by Aug 19, 2019, 2:17 PM

        After re-reading Derelict comment it is much clearer.
        Let me know if i'm right or not.

        All rules are read and parsed in order of the ruleset.
        The rule order is floating > group > interface
        All match rules should apply before pass/block rules

        For match rules (last match case, all rules should be read)
        quick flag is unrelevant
        if there is a match set the modifier (queue/tag) to the one dictated by this rule
        Read Next rule
        Loop until there are no more rules.
        Apply the modifier.

        For pass/block rules (first match case, maybe not all the rules needs to be read)
        If there is a match and rule is quick, stop reading and apply action.
        If there is a match but rule is not quick save the action (only first time).
        Read next rule.
        Loop until there are no more rules.
        If there is a saved action apply the action.

        @turrican64

        However Quick flag reverses the behavior of “first match wins” to be “last match wins”.
        Therefore if there is another rule after the Quick rule which matches that will takes effect not the Quick one.

        Sorry, but I don't think this is correct
        Try
        quick floating allow ping
        quick floating deny ping

        Ping will be allowed
        (If there is a match on a quick rule there is not further evaluation.)

        T 1 Reply Last reply Aug 19, 2019, 4:40 PM Reply Quote 0
        • T
          turrican64 @chriva
          last edited by turrican64 Aug 19, 2019, 4:48 PM Aug 19, 2019, 4:40 PM

          @chriva

          So sorry I meant the other way around

          However Without Quick flag reverses the behavior of “first match wins” to be “last match wins”.
          Therefore if there is another rule after the NON Quick rule which matches that will take effect not the NON Quick one.

          1 Reply Last reply Reply Quote 0
          • K
            kiokoman LAYER 8
            last edited by Aug 19, 2019, 5:34 PM

            something like this ?
            Diagram.jpg

            ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
            Please do not use chat/PM to ask for help
            we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
            Don't forget to Upvote with the 👍 button for any post you find to be helpful.

            1 Reply Last reply Reply Quote 0
            • D
              Derelict LAYER 8 Netgate
              last edited by Derelict Aug 19, 2019, 5:37 PM Aug 19, 2019, 5:37 PM

              All rules without quick set do is modify the default treatment of the packet should nothing else further down in the rule set change it.

              It's really that simple.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • T
                turrican64 @Derelict
                last edited by turrican64 Aug 19, 2019, 9:23 PM Aug 19, 2019, 9:23 PM

                @Derelict said in Floating vs Interface rules processing order:

                block in log inet all tracker 1000000103 label "Default deny rule IPv4"
                block out log inet all tracker 1000000104 label "Default deny rule IPv4"
                

                These are very high in the rule set and do not have quick set. They set every packet to be blocked in or out of any interface. When all the other rules have been processed and the end of the rule set is reached and no other rule has changed the behavior and passed or blocked it, then that action is taken and the packet is dropped.

                Based on the above if I create only 1 rule for example

                allow in dst 10.0.0.1 Quick:NO
                

                will never take effect because the also non quick rule

                block in log inet all tracker 1000000103 label "Default deny rule IPv4
                

                is higher in the rule set (“last match wins”).
                Correct?

                1 Reply Last reply Reply Quote 0
                • D
                  Derelict LAYER 8 Netgate
                  last edited by Aug 19, 2019, 9:47 PM

                  Man...

                  block in log inet all tracker 1000000103 label "Default deny rule IPv4

                  That sets the default deny on all traffic.

                  Then, further down the rule set:

                  allow in dst 10.0.0.1 Quick:NO

                  That changes that behavior.

                  As long as nothing further down the rule set matches and changes that allow, it will be passed.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • T
                    turrican64
                    last edited by Aug 19, 2019, 9:49 PM

                    Ok
                    block in log inet all tracker 1000000103 label "Default deny rule IPv4
                    is at the very top of the ruleset.

                    Clear

                    1 Reply Last reply Reply Quote 0
                    • D
                      Derelict LAYER 8 Netgate
                      last edited by Aug 19, 2019, 9:50 PM

                      cat /tmp/rules.debug

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      41 out of 41
                      • First post
                        41/41
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                        This community forum collects and processes your personal information.
                        consent.not_received