[PARTSOLV] Firewall Aliases – Function of Statistics Option

[wiring8228]

What does the 'Statistics' option, which has the description 'Maintain a set of counters for each table entry', actually do? Which counters is it referencing?

I can't see any change in Diagnostics > Aliases when I activate this option for an alias.
The following is the only documentation I could find about it: https://docs.opnsense.org/manual/diagnostics_firewall.html#aliases

[pfry]

It only counts pass matches... most of the time. I don't think I ever characterized it fully, and I've forgotten the details. How are the aliases you are testing applied?

[Seimus]

The counter increases only for non Port based aliases.

Regards,
S.

[wiring8228]

I'm using a GeoIP alias that gets used in firewall rules to only allow traffic to some countries (whitelist principle).

[wiring8228]

So, what could the Statistics option be useful for? I asked AI about it, and now I think I understand that the counters simply keep track of how many times packets were passed or blocked using the alias where the Statistics option is enabled.

Do you perhaps have a correction or a better explanation for this?

[Patrick M. Hausen]

[...] the counters simply keep track of how many times packets were passed or blocked using the alias where the Statistics option is enabled.

Exactly.

[wiring8228]

As a test, I enabled the Statistics option for a URL table alias that has a blocking rule set for outbound traffic.

So I simply pinged one of these blocked addresses, which was blocked as shown in Firewall Live View.
However, when I go to Firewall --> Diagnostics --> Aliases, neither the packet nor the byte counters for that address have increased.

IP address range from alias: 1.10.16.0/20
IP address pinged: 1.10.16.1

[pfry]

As I said, it appears to count pass matches (specifically matches that create a session/state). I only investigated in an offhand fashion a couple years ago, so feel free to correct me.

[Seimus]

Did you in the tabulator UI put all the statics fields?

Because by default only some are shown, other you need to enable to be visible on the page.

Regards,
S.