Floating rules are processed before interface group rules and interface rules??
demux last edited by
The documentation for floating rules states:
Floating rules are processed before interface group rules and interface rules...
But it also states:
Using the Tag and Tagged fields, a connection can be marked by an interface tab rule and then matched in the outbound direction on a floating rule...
I understand the second statement that interface rules are processed first, otherwise they have no tag.
Can someone please clarify that for me?
I would like to block private IP traffic to outside and I would still like to have access to the cable modem (on 192.168.100.1). I thought of marking the packets on the LAN interface destined to the cable modem. Then I thought of creating two floating rules on the WAN interface (outgoing direction): first one matches the mark and lets the packets through to the cable modem and the second one, after that, blocks all private IP addresses.
Will this work?
Thanks for your help,
Gertjan last edited by
I would like to block private IP traffic to outside
If you can connect to your WAN-connected cable modem using it's RFC 1918 IP address then that traffic will end at the modem. It can not be routed elsewhere.