<![CDATA[Unnecessary rules]]>pfSense utilizes a default deny philosophy, yet I've seen a number of guide online that explicitly define reject rules.

Here is an example of a guest VLAN showing a number of reject rules.

Capture.PNG

Are these rules unnecessary?

]]>https://forum.netgate.com/topic/148209/unnecessary-rulesRSS for NodeTue, 14 Jul 2026 01:09:30 GMTMon, 18 Nov 2019 23:13:19 GMT60<![CDATA[Reply to Unnecessary rules on Wed, 20 Nov 2019 13:59:55 GMT]]>As @stephenw10 mentioned, using Reject internally is one good reason, but there are also other reasons someone might want explicit block/reject rules, such as:

  • To fine-tune which blocked traffic gets logged / not logged
  • In combination with policy routing rules and the "Skip rules when gateway is down" option so that policy routed traffic will fall through to specific block rules if a gateway is offline
  • To make the ruleset easier to read for less experienced admins who are not familiar with the default block behavior
]]>https://forum.netgate.com/post/876713https://forum.netgate.com/post/876713Wed, 20 Nov 2019 13:59:55 GMT<![CDATA[Reply to Unnecessary rules on Tue, 19 Nov 2019 17:06:55 GMT]]>Reject for internal clients is a good option. It replies reject specifically to the client which means it immediately closes the connection rather than having to timeout.
Be aware though that unless you enable logging on those rules you won't see it in the firewall log, unlike default blocked traffic. That can make troubleshooting harder.

Steve

]]>https://forum.netgate.com/post/876557https://forum.netgate.com/post/876557Tue, 19 Nov 2019 17:06:55 GMT