Hi all
I am in the process of migrating from an old Edgerouter 4 to OPNSense, and for the most part, i've gotten things working as intended, but, I currently have a single pain-point that I am not entirely sure about.
I am currently using 3 ports on my device, 0 is WAN (which I do not think is relevant for this), I have a routed /29 on a server in port 1, and then I have my LAN on port 2.
When I connect to a TCP based service on my server from my LAN (port 2 to port 1), I can connect just fine, so the firewall rule work, but after 15 or so seconds, I start seeing "Default deny / state violation rule" in the firewall log, and then the session is disconnected.
But, if I set State Type to sloppy state, then it works as intended.
The docs does not say much about sloppy state tracking, so my question is, is it a "bad" thing to enable?
Or is it just something that is required, maybe due to the way I have configured my network? (The service is running in a docker container with port binding, so there might be more in play here than just OPNsense)
The setup seems to work fine for external connections, so I would not think it should be a big security issue having it enabled on LAN only connections.
From your subject I figured you were talking about "Bind states to interface". Personally I'd dig into why normal "State Type: keep state" does not work for you. It suggests a client/server TCP issue, packet loss, and/or partial bypass of the firewall. Packet loss at least should be obvious - it kills performance. I can't think of a practical security exploit for sloppy state offhand, but that doesn't say much.