Anchors not processing

gidotop · Mar 7, 2020, 6:29 PM

I am trying to dynamically add rules to some of the built in anchors to block/allow traffic dynamically when another device ssh's in and runs the appropriate commands, but the pfsense firewall seems to skip right over the built in anchors. Here is what was done so far.

I created a sample rule of what I need done and added it in the webGUI like normal, then tested it. I then ran a pfctrl -sr and copied that rule so I had the syntax correct. I removed the rule in the webGUI and then use the echo "rule" | pfctrl -a userrules -f - to add the rule to the anchor. I checked to make sure it is there with pfctrl -a userrules -sr and it was added correctly, but when I test the rule it isn't processed by the pfsense at all. Is there so other step to using the anchors besides inserting a rule? According to everything I have read that is all that is required. Thanks

jimp · Mar 9, 2020, 7:44 PM

Without seeing the exact contents of the rule/anchor and exactly what you tested, there is no way to know what might have happened.

Anchors shouldn't take anything extra to activate, the internal ones that get actively used, like miniupnpd work without anything special.

gidotop · Mar 10, 2020, 1:27 AM

So a good example would be something like this:

pfctrl -sr currently prints out the rule set and userrules anchor (anchor "userrules/*" all) is empty. I have confirmed with a pfctrl -a userrules -sr which returns nothing. I then added the following:

echo "pass in quick on em0 inet proto tcp from 192.168.1.7 to any port = 32400 flags S/SA keep state" | pfctl -a userrules -f -

when I run pfctrl -a userrules -sr after this I get:
pass in quick on em0 inet proto tcp from 192.168.1.7 to any port = 32400 flags S/SA keep state

The rule doesn't work though and it doesn't display with a pfctrl -sr either. I can't see what I am specifying wrong, I have tried calling the anchor with and with out the /* in quotes a few times and it places the new rule under the userrules anchor as displayed with pfctl -a userrules -sr each time. I can clear it with pfctl -a userrules -Fr as well. Given this example can you see where I have gone astray? Thank you for your help.