Invert Rule question

  • I thought I had it all figured out. I want traffic destined to to ONLY be able to communicate over power 443 (and nothing else). So I made a block rule;
    Screen Shot 2019-08-13 at 8.52.00 AM.png

    I figured I'm reading this as "block all traffic to this address unless it's over port 443"

    Obviously I'm doing something wrong, as traffic over other ports to this address is being passed.

  • I read that rule as "Block all traffic to port 443 everywhere except"

    Also remember to reset your states after making a rule change that blocks traffic. Existing states are not affected by a rule change.

  • LAYER 8 Global Moderator

    Where did you put that rule, what rules are above it? What rules are below it.

    Rules are evaluated top down, first rule to trigger wins, no other rules evaluated. As traffic enters the interface from that network.

    That rule says if destination is anything other than to port 433 block. But it doesn't allow traffic to anything, if traffic doesn't match that rule it just moves to next rule.

    So say your dest was port 80, it would look to rules below.

    Also ! rules can be tricky if you have any vips setup.. You should prob be explicit in your rule design.

    If you want to allow only traffic to on port 443 then allow that, and below it put a block all rule.

    Really need to see your full set of rules to know what is happening.

Log in to reply