Firwall rules using aliases
-
I have taken a somewhat 'paranoid' policy on the network to only allow traffic to connect from certain IP ranges by defining them in an 'allow_connect' alias and then using that in my firewall rules. This is working pretty well, but when I need to make a change to the alias – add another range of IPs that are allowed to connect, I can't seem to make the changes take affect on the firewall side. How do I force a refresh of this so the rules are truly updated?
-
Reset the states affected by going to Diagnostics - States. Filter for the ones you want (so you don't interrupt other connections) and then reset them. New connections will abide by thenew rules.
-
Tried that without success. I even tried adding an easy rule to allow the connection through, and it still won't connect. Other ideas?
-
I was able to get it working. I entered the new CIDR address wrong. Clearing the state table did take care of it once I had that fixed. Thank you for the help.
A question about CIDR, what is the differenct between saying something like this: x.x.x.1/16 vs x.x.x.0/16 ?
-
A question about CIDR, what is the differenct between saying something like this: x.x.x.1/16 vs x.x.x.0/16 ?
When specifying a subnet (rather than a host) it does not make a difference. "/16" is saying to take notice of only the top 16 bits (first 2 numbers). 99% of router software should cope with either in its configuration, but the convention is to write x.x.x.0/16
When specifying a specific host IP, then you have to specify the whole address and network prefix x.x.x.1/16
-
And you only have to reset states to kill existing connections that you have removed pass rules for. If you make a rule more permissive, allowing new connections, you don't have to reset states. They will be passed when the connection is attempted.
