Match rule - pass or drop?
-
Docs say:
"Firewall rules on Interface and Group tabs process traffic in the Inbound direction and are processed from the top down, stopping at the first match."
"Floating rules without quick set process as “last match wins” instead of “first match wins”
"Apply traffic shaping to match traffic but not affect it’s pass/block action"Now generally rule processing stops when a match is found. I see that floating rules are different and can be either first or last match is the rule that goes into effect depending on whether 'quick' is on or off. I understand that floating rules work differently.
What I can't seem to find the answer to is what happens when a 'match' rule is matched? If it is not blocked/rejected/allowed does it just get attributes added to it and go on to match a second rule? Breaking the concept of 'rule processing stops at the first rule that matches?
-
Traffic is neither passed nor blocked. It is matched. You can do things like assign a queue or a tag or log it but it does not change the pass or drop status of the traffic.
quick has no bearing on match rules. They always flow though and rule processing continues.
