Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Is rule ordering reflected in the output of /tmp/rules.debug?

    Scheduled Pinned Locked Moved Firewalling
    3 Posts 3 Posters 544 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      ljwobker
      last edited by

      I know the output of /tmp/rules.debug is automatically generated and therefore not guaranteed to be authoritative… however, is the rule ordering (top down) that is shown in rules.debug enforced by the system?

      Asked another way - if all of my default block rules appear at the TOP of the rules.debug output, is this because the code writes them out this way, or because the system is actually enforcing those rules first?  (which would break damn near everthing  ;-)

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned
        last edited by

        Run

        pfctl -sr
        

        compare with  /tmp/rules.debug and see for yourself.

        1 Reply Last reply Reply Quote 0
        • M
          mer
          last edited by

          Default block rules at the top don't necessarily break everything.  If they have a quick keyword on them, yes they do, no quick no break.  Down in the guts of pf, rules are evaluated as "last match wins".  If you have something like this (syntax may not be exact):

          block in em0
          pass in on em0 from any to http

          You're blocking everything except for traffic to port 80 (http).

          if it says
          block in quick em0
          pass in on em0 from any to http

          You've denied everything inbound on em0.  The quick keyword  means "if we matched on this rule, don't look at any other rules.  Just exit rule evaluation".

          The command from dok shows you the order that pf will be evaluating the rules (and any expansions that have happened).  There are lots of "quicks" in there, so matching traffic stops evaluating.

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.