"
I found the documentation about stateful have needing to do a reset.
https://docs.opnsense.org/manual/firewall.html
https://docs.opnsense.org/manual/firewall.html
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
Pages1
#1
20.7 Legacy Series / Re: Existing connections still working after Disabled/Deleting rules
October 31, 2020, 01:08:27 AM #2
20.7 Legacy Series / Re: Existing connections still working after Disabled/Deleting rules
October 31, 2020, 01:05:45 AM
Is there a way to disable to "feature" ?
No vendor's firewall (meraki, cisco, sonic wall, sophos and barracuda just to name a few) I've ever used has ever allowed existing connection(s) to continue after a rule was removed
when the default was to block. This kind of stateful makes sense for proxies (haproxy as an example) or a application like samba. It also doesn't make sense why adding a block rule also doesn't stop these existing connections.
What if I needed to deal with an "problem" connection and needed to alter a rule, that existing problem connection would be allowed to continue ?
Quote from: mimugmail on October 30, 2020, 07:21:32 PM
Because it's stateful, it's the usual behavior for most vendors
No vendor's firewall (meraki, cisco, sonic wall, sophos and barracuda just to name a few) I've ever used has ever allowed existing connection(s) to continue after a rule was removed
when the default was to block. This kind of stateful makes sense for proxies (haproxy as an example) or a application like samba. It also doesn't make sense why adding a block rule also doesn't stop these existing connections.
What if I needed to deal with an "problem" connection and needed to alter a rule, that existing problem connection would be allowed to continue ?
#3
20.7 Legacy Series / Existing connections still working after Disabled/Deleting rules
October 30, 2020, 07:18:02 PM
I have 3 interfaces WAN,LAN1,LAN2 and a rule to allow ICMP packets from LAN1 to LAN2. After disabling and or deleting this rule. Existing connections are still allowed to continue. Unless I reboot the firewall, "States Reset" or wait for the existing connection to stop transmitting anything long enough for them to timeout.
Why doesn't disabling or deleting the rules automatically kill these connections ?
Why doesn't disabling or deleting the rules automatically kill these connections ?
Pages1
