Geo block takes precedence over all other rules?
-
I'm not new to pfSense, so I don't believe I'm doing anything wrong but maybe I am...or maybe I just couldn't find the pertinent information regarding Geo block rule order.
It seems to me that these lists are processed first no matter what. I have Geo block rules for a few countries set as a floating rule, blocking in/out. Above these rules I have some floating rules to permit access to port 80 and 443 for certain domain names and IPs. They are set as "quick". I also changed the pfBlocker rule order to put all permits first.
Even though my rule order would suggest the permit is applied first, the IP of where I'm trying to go is always caught by the Geo block rule.
From the pics above you can see IP 185.230.63.171 as an example. If I try to go to that IP the permit rule never sees it, as the states/bytes never increase, but the Asia outbound block rule sees it and blocks the traffic.
I've reset states and the FW but it still happens. I've gotten around this issue by disabling the outbound block and only blocking inbound, but it seems to me that something is wrong or not documented fully.
-
@belze yes floating are evaluated before interface rules.
https://docs.netgate.com/pfsense/en/latest/firewall/rule-methodology.html#rule-processing-order
Floating Rules Interface Group Rules Interface Rules -
@johnpoz Thanks for the response. I should have elaborated more.
I know floating rules are evaluated before interface rules, but are the rules ALWAYS evaluated top down per rule tab (LAN, WAN, Floating, etc)?If so, this seems to be unintended behavior since I set the "quick" option on the pass rules.
I can always get around it by say putting the Geo block on the interfaces and the permits on the floating tab, but if what I'm seeing is a bug I wanted to get it out here so it could be fixed.
-
@belze said in Geo block takes precedence over all other rules?:
but if what I'm seeing is a bug I wanted to get it out here so it could be fixed.
No bug, your rules are just messy as hell, some basics are missing.
-
@belze Set the Geo entry up as Alias Native and then it just creates an alias. you can then create your own rules in the order you wish.
-
^ exactly - this is what I would do.. And what I do do for my use of geoip based rules.. But I don't block with them - I allow with them. Only allow the countries my users are in for plex, etc..
