Interface Group Default Deny?
-
Do the interface group have a Default (implicit) Deny, if user defined rules are NOT matched?
I assume it does NOT have a default (implicit) deny since it needs to allow the traffice to move onto interface rules for matching. I just want to verify, the documentation seems a little unclear on this scenario.
Thanks
-
@roebuck45
Yes. But there is no default deny rule on each interface or group at all.
pfSense has rather a certain Ordering of NAT and Firewall Processing, where the default deny rule is on the very last position.So consider that rules on the respective member interface tab are probed as well and applied in case of matching, if none on the group tab matches.
-
Making sure I am understanding correctly, the default deny is essentially a gloabl configuration, so if no match is found in a group or individual interface rule, pfsense blocks it?
-
@roebuck45
Yes, if none of the rules, either on floating, group or interface tab matches the traffic, the default deny rule is applied. -
Awesome, thanks for the clarification!