IF Groups with Multi WAN IFs

demux

Hi,

the documentaton says it's not a good idea to use IF groups with Multi WAN IFs because of reply-to. Understood.

Rules in the combined Multi WAN tab do not get the reply-to. What about the other (normal) WAN IF tabs? Do they still get the reply-to? If yes, the Multi WAN IF group's tab would be great for all the deny stuff, where I won't answer anyway.
Things to be answered or act on would then go to the individual WAN IFs' tabs.

Did I get it right?

Thanx,
-demux

viragomann

@demux said in IF Groups with Multi WAN IFs:

What about the other (normal) WAN IF tabs? Do they still get the reply-to? If yes, the Multi WAN IF group's tab would be great for all the deny stuff, where I won't answer anyway.
Things to be answered or act on would then go to the individual WAN IFs' tabs.

Yes, that's correct.
You can use an interface group for block rules (or you can add floating block rules therefor) and put the pass rules for incoming traffic on the interface tabs.

However, I'm wondering what you want to block on WANs? Anything that is not explicitly allowed by a pass rule is blocked anyway.