Strange behaviour with alias firewalling: Pass is logged but traffic is blocked
-
Today I'm facing a weird behavior on one of our PF boxes, this one is a 2.7.2 release, but I had it before on an other box as well a month ago. A generic explanation:
We have an IP alias "Abuse_IPs" containing some IP's and FQDN's of abusive IP's.
On our WAN interface we have a simple block any rule when source is Abuse_IPs.An accidentally added FQDN in this alias needed to be removed. Before removal the address was blocked and logged as blocked, as it should. After removing the entry, the address starts appearing as allowed in the firewall log, but the traffic is still blocked somewhere. Packet captures on the "next hop" show no traffic coming from the PF towards the allowed IP.
Rebooting the PF fixed the problem previously.I tried reloading the filter, flushing the states, but it has no use, only a reboot seems to fix the problem.
-
I managed to resolve my above issue and for anyone ending up with the same question:
My issue was caused because of a colleague who added a floating rule, rejecting traffic coming form another alias with logging disabled on that rule. Unfortunately that alias contained a different FQDN that resolved to the same IP of the removed FQDN.
What is the important lesson here:
Apparently the PF box handles floating rules AFTER interface rules. And since logging of that floating rule was disabled, the firewall log logged the allowed traffic from the interface rule, but blocked the traffic afterwards based on the floating rule with no logging! You end up seeing an allow in your log, but it is blocked in the end!
This must be a culprit some else will face one day or another :)