Multiple blockings in firewall logs

dims

I see a log of block events in

Status - System Logs - Firewall - Normal View

events are of UDP and when I click at block icon it says

Unfortunately, I can't find any rule with this name in Firewall config.

What is it?

viragomann

The default deny rule isn't shown in the firewall rule list. It's an imaginary rule placed at the end of the rule set which blocks everything. So everything which isn't permitted by any rule above is blocked.

You can disable the logging of this rule in the log settings.

johnpoz

So what part of "DEFAULT Deny Rule IPv4" is confusing I'm curious??

KOM

So what part of "DEFAULT Deny Rule IPv4" is confusing I'm curious??

Probably the part where you don't see that rule in your ruleset. The default deny rule should be visible at the bottom but greyed-out so you can't fiddle with it.

johnpoz

Somewhat agree, I think ALL rules should be listed for example the rules that get put in place when you enabled dhcp server, etc.

I think they don't show some of these rules because most of them would just confuse the shit out of users ;) But its pretty clear in any docs you read there is a default deny rule!

https://doc.pfsense.org/index.php/Firewall_Rule_Basics
Where no user-configured firewall rules match, traffic is denied

https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting
If it says "Default Deny", and the packet should have been allowed, then it did not match any rule in the ruleset.

https://doc.pfsense.org/index.php/Firewall_Logs
The Firewall logs at Status > System Logs on the Firewall tab show all events logged by the firewall. By default, this includes connections blocked by the default deny rule.

It might be nice if there was a checkbox for say advanced view of the rules that shows everything.. But come on, maybe the user didn't understand what "default" means??

mer

That's why there's "pfctl -sr". Shows the expansions of any aliases, all the "quicks" on the user rules.

johnpoz

User can not figure out what default deny rule means, and you think he is going to figure out what the output of pfctl -sr means? ;) yeah ok sure ROFL…

dims

@viragomann:

So everything which isn't permitted by any rule above is blocked.

I have empty rule list, so it should be everything blocked then?

viragomann

That's right.

But by default pfSense has a "default allow rule" on LAN interface to allow any outgoing traffic from LAN. If you've deleted this one, everything should be blocked.