Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    {Complete} Timebased Rules

    Completed Bounties
    10
    187
    132.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      heiko
      last edited by

      I will test it, i´am disappointed

      1 Reply Last reply Reply Quote 0
      • S
        sullrich
        last edited by

        Why are you disappointed?

        1 Reply Last reply Reply Quote 0
        • H
          heiko
          last edited by

          no comment, i will test it

          1 Reply Last reply Reply Quote 0
          • S
            sullrich
            last edited by

            I think our language barriers are getting in the way.  Is there someone out there that can help translate?

            1 Reply Last reply Reply Quote 0
            • H
              heiko
              last edited by

              Scott,
              i think we are finished the project.
              Thank you for the the great coding.
              heiko

              1 Reply Last reply Reply Quote 0
              • S
                sullrich
                last edited by

                I am confused, so everything works okay?

                1 Reply Last reply Reply Quote 0
                • H
                  heiko
                  last edited by

                  No, i think it is not working, but you work very well, but i want not a conflict..

                  1 Reply Last reply Reply Quote 0
                  • S
                    sullrich
                    last edited by

                    Nobody is creating a conflict.  I just cannot duplicate the problem..

                    When I permit or deny ICMP traffic on the WAN interface it stops as it should.

                    1 Reply Last reply Reply Quote 0
                    • H
                      heiko
                      last edited by

                      OK, then it is vmware problem, i think

                      1 Reply Last reply Reply Quote 0
                      • S
                        sullrich
                        last edited by

                        Do you speak german?  Please join #pfsenseDE on FreeNODE.

                        1 Reply Last reply Reply Quote 0
                        • S
                          sullrich
                          last edited by

                          I have a feeling that I know what you are testing.

                          Is this what you did?

                          ping the wan ip from a client continually (-t on windows)
                          add icmp allow rule on wan tab
                          client can now ping the wan
                          remove the wan icmp rule and apply
                          client can still ping firewall (pf state exists, you must ctrl-c and ping again or clear states)

                          Where I think the confusion is that I had to do some ipfw mastery to override the pf rules for schedules.  And that is the reason why ICMP will be blocked correctly on a schedule.  PF rules themselves have not changed so if a state already exists and you remove the rule that session will remain active until it closes or you clear the states on the firewall.

                          1 Reply Last reply Reply Quote 0
                          • H
                            heiko
                            last edited by

                            Scott,

                            that´s it. COMPLETELY

                            1 Reply Last reply Reply Quote 0
                            • S
                              sullrich
                              last edited by

                              Good deal.  Do you understand now why it works that way?  It has always worked that way due to it being a stateful firewall.

                              In terms of the cosmetic GUI issues, we will look into them.

                              But at this point is the system working for you?  I really need to get 1.2 tagged in CVS and begin the 1.2 beta engineering process.

                              1 Reply Last reply Reply Quote 0
                              • H
                                heiko
                                last edited by

                                Boh Scott,
                                yes i do, but we can i test this completley out with schedules on a rule?

                                1 Reply Last reply Reply Quote 0
                                • S
                                  sullrich
                                  last edited by

                                  Yes, please test and let me know when you are happy with it.

                                  1 Reply Last reply Reply Quote 0
                                  • H
                                    heiko
                                    last edited by

                                    a new snapshot?

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      sullrich
                                      last edited by

                                      Sure, that will work.  There have been no commits for atleast 9+ hours.

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        heiko
                                        last edited by

                                        Hm? but i will test it

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          sullrich
                                          last edited by

                                          Hm?  Sorry, I do not understand?  What are you trying to tell me?

                                          1 Reply Last reply Reply Quote 0
                                          • H
                                            heiko
                                            last edited by

                                            Hallo,
                                            ich schreibs ausnahmsweise auf Deutsch, Entschuldigung dafür. Ich möchte an dieser Stelle ausdrücklich vermeiden, dass es zu Unstimmigkeiten bzgl. des Projektes kommt. Das "Bounty" ist gezahlt und zwar sehr gerne. Sollte es Probleme mit dem löschen von Firewall Sessions kommen, die durch dieses Projekt verursacht wurden, so bin ich gerne bereit, eine entsprechende Summe zu zahlen, um dieses Problem zu lösen. Es liegt mir fern, ein Projekt zu kaufen! Dies möchte ich noch einmal ausdrücklich betonen.

                                            Mein Test hat gezeigt, dass Firewall Regeln nicht korrekt geladen bzw. umgesetzt werden, dass im ersten Test sogar ohne Zeitbasierte-Regeln. Es ist nicht viel falsch zu machen, eine Regel zu erstellen, welche ICMP erlaubt oder blockt. Da dies nicht erfolgreich durchgeführt werden konnte, habe ich den Test abgebrochen,da es für mich keinen Sinn macht, etwas zu testen, was hier nicht sehr wissenschaftlich ist, denn ich kann nicht erkennen ob es Fehler an den Schedules gibt oder durch einen kausalen Zusammenhang anderer Dinge.

                                            Gruß
                                            Heiko

                                            Holger, es wäre sehr nett, wenn Du das übersetzen würdest, damit dieses erfolgreich zum Abschluß kommt und alle Beteiligten davon profitieren können…

                                            P.S..: Ich teste alles unter VMWARE, vielleicht ist das auch ein Problem?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post