Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    What is the meaning of the "Quick" option:

    Firewalling
    2
    2
    1344
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      masterblaster last edited by

      What is the meaning of the Quick Option in the Floating rules? And in which purposes i have to use the Floating rules?
      The reason for my question is that i have configured CARP on my pfSense Firewallcluster and i can ping the "non CARP" LAN interfaces of the 2 machines but not the shared interface from the LAN. Since the Floating rules can be used for all interfaces i decided to create Rules for diagnostic purpuses (ICMP rules from and to several networks) into this container for a quick overview.
      When i create a rule which passes ICMP traffik to the shared interface it only works when i enable the "Quick" option, if i disable the option no ICMP requests are answered.

      1 Reply Last reply Reply Quote 0
      • jimp
        jimp Rebel Alliance Developer Netgate last edited by

        quick means that the firewall will stop processing rules when it hits a match. If you don't use quick, it's last-match-wins instead of first-match-wins.

        All of the rules on normal interfaces (wan, lan, etc) have quick enabled internally by pfSense.

        Floating rules can be used to control how traffic is allowed to leave the firewall itself (though if it matches a rule on any other interface, it would be bypassed because it would already have an existing state).

        Pretty much "If you don't know what they do, you probably don't need them" :-)

        There is no reason you should need floating rules to do what you are talking about. A pass rule for ICMP on the normal interface rules should suffice. If you really want to allow it in on all interfaces, an Interface Group would be more appropriate, though a floating rule may get the job done.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post

        Products

        • Platform Overview
        • TNSR
        • pfSense
        • Appliances

        Services

        • Training
        • Professional Services

        Support

        • Subscription Plans
        • Contact Support
        • Product Lifecycle
        • Documentation

        News

        • Media Coverage
        • Press
        • Events

        Resources

        • Blog
        • FAQ
        • Find a Partner
        • Resource Library
        • Security Information

        Company

        • About Us
        • Careers
        • Partners
        • Contact Us
        • Legal
        Our Mission

        We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

        Subscribe to our Newsletter

        Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

        © 2021 Rubicon Communications, LLC | Privacy Policy