Traffic passing with rules disabled

markvr

Sorry to post again(!). Still seem to be struggling with pfSense.
Have a transparent bridge:
internet - WAN - pfsense - LAN - hosts

With "Enable filtering bridge" switched off, hosts can ping internet (CORRECT)
Enable filtering bridge - Hosts can't ping internet (CORRECT)
Add rule to allow traffic through, apply rules. Hosts can now ping (CORRECT)
Change rule to block traffic, apply rules. Hosts can STILL ping (INCORRECT)

If I reboot the firewall, or untick, save, retick and save the "Enable filtering bridge" option then the "block" rule takes effect.

It seems that the "rule reload" doesn't always work? Even though checking the "reload status" shows that they have been reloaded.

It does however work in reverse.
ie, once traffic is being blocked correctly, change the rule to "pass" and applying will start to allow traffic again.

jahonix

IIRC, when you change a rule to block traffic then the state from your previous test is still alive.
Look at Diagnostics | States to verify this.

@markvr:

If I reboot the firewall, or untick, save, retick and save the "Enable filtering bridge" option then the "block" rule takes effect.

Then the states get reset…

markvr

jahonix, you are a legend. Clearing the state table fixed it.

Now just to try and get CARP working on a bridged interface. Some say it can be done, and some say it can't!

hoba

CARP will not work on bridges.

markvr

yes it will :D
http://forum.pfsense.org/index.php/topic,6516.0.html