List or toggle rules on/off via CLI
-
In case this comes in handy to anyone, here's a little script that can list, enable, or disable rules via CLI.
GitHub: luckman212/pf_fwrule_toggle
Usage
- list rules:
php -q fwrule_toggle.php -l - toggle rules 36 and 41:
php -q fwrule_toggle.php 36,41 - toggle NAT rule 17:
php -q fwrule_toggle.php n17 - turn rule 23 on:
php -q fwrule_toggle.php 23 enable - turn NAT rule named "camera" off:
php -q fwrule_toggle.php -d camera nat disable
previous locked thread: https://forum.netgate.com/topic/51063/enable-disable-existing-rule-via-script/
- list rules:
-
@luckman212
Thanks for posting this and including examples. -
@luckman212 Any way to make this script also adjust NAT rules? I thought I was golden when I tested it, then realized I needed it for NAT rules that have linked firewall rules.
Edit:
Actually, disabling firewall rule would still effectively render NAT rule useless without it, so maybe that is fine. -
For anyone not watching the repo, I updated this to add the ability to toggle NAT rules as well with e.g.
n14as the ruleid. -
@luckman212 I use this nearly every day. I have a small homebridge node script so I can use siri turn on/off the rule. Sometimes the rule is a different index and I screw something else up. I‘ve tried to find a programmatic method to get the rile Id but can’t find it. Pfctl can show but only when rule is enabled. Any other ideas?
-
@stevemac00 It's a bit odd that the rule IDs are changing for you. Do you use pfBlocker? In any case, I could add a function to operate on rules based on the description.
You'd want to have a unique description set for this rule. If >1 rule had the same description (eg a rule named "allow ping" that existed on 2 separate VLANs) then I'm not sure what the script should do... toggle all of them? just the first one? or error out and complain?
-
@luckman212 Answer yes to pfblockerng but I'm not placing any blame. If another unrelated rule is disabled (prior to this rule in the pfctl list), that action will cause this rule's index to change and therefore script will enable/disable wrong rule.
So, I think an unambiguous keyword in description is preferable. Maybe enclose it double asterisks so my rule description could be something like
"Automated **MBVPN** rule to enable VPN gateway for this host or alias"
and then find by key**MBVPN**Thank you again for your efforts and support!
-
@stevemac00 Tried this:
I pass your script my descriptive term MBVPN and get rule index (id)ruleid=`sudo php -q /home/steve/fwrule_toggle.php -l | perl -ne 'print if s/\s{2}(\d+).{3}lan\s\(**MBVPN**\)/$1/g'`I'm not a perl user but seems to work.
-
@stevemac00 That's neat but why sudo though? I should have time later today to build in a matching function. I was also planning to accept a comma separated list of rules to allow multiple operations without forking php so many times.
-
@stevemac00 I just pushed an update that adds some features. Give it a try when you can.
- You can operate on rule(s) based on description now, as well as specify multiple ruleIDs as a comma separated parameter for batch operations.
- If >1 rule matches a description, they will be actioned as a group.
- Changes are output at the console as well as logged to the GUI > System Log.
