Firwall rules using aliases



  • I have taken a somewhat 'paranoid' policy on the network to only allow traffic to connect from certain IP ranges by defining them in an 'allow_connect' alias and then using that in my firewall rules.  This is working pretty well, but when I need to make a change to the alias – add another range of IPs that are allowed to connect, I can't seem to make the changes take affect on the firewall side.  How do I force a refresh of this so the rules are truly updated?



  • Reset the states affected by going to Diagnostics - States.  Filter for the ones you want (so you don't interrupt other connections) and then reset them.  New connections will abide by thenew rules.



  • Tried that without success.  I even tried adding an easy rule to allow the connection through, and it still won't connect.  Other ideas?



  • I was able to get it working.  I entered the new CIDR address wrong.  Clearing the state table did take care of it once I had that fixed.  Thank you for the help.

    A question about CIDR, what is the differenct between saying something like this: x.x.x.1/16 vs x.x.x.0/16 ?



  • A question about CIDR, what is the differenct between saying something like this: x.x.x.1/16 vs x.x.x.0/16 ?

    When specifying a subnet (rather than a host) it does not make a difference. "/16" is saying to take notice of only the top 16 bits (first 2 numbers). 99% of router software should cope with either in its configuration, but the convention is to write x.x.x.0/16

    When specifying a specific host IP, then you have to specify the whole address and network prefix x.x.x.1/16


  • LAYER 8 Netgate

    And you only have to reset states to kill existing connections that you have removed pass rules for.  If you make a rule more permissive, allowing new connections, you don't have to reset states.  They will be passed when the connection is attempted.


Log in to reply