Rule Separators

[pfry]

I would love to have a hierarchical tree view [...]

An arbitrary hierarchy? Heh. That type of UI would work well with one odd firewall I had many years ago: It used longest-match filters, like a routing table. No sequential evaluation. With a sequentially ordered ruleset like pf you'd likely want to do something similar (specify most relevant fields) in order to avoid having rule order bite you.

Simply using a multiple-selection UI (e.g. as you said, a typical file system GUI) would allow manipulation of groups of rules; file system-like containers would allow hierarchical organization with descriptions/banners/whatever.

OPNsense is perfectly OK. IMHO don't bother with separators but think about if it is conceivable to implement the real thing.

I have to agree there. All it takes is money and time.

Would category labels/messages/banners/whatever help anyone?

[Monviech (Cedrik)]

The current categories are a one to many relationship. You can add multiple categories to the same rule. So it cannot be a linear one to one folder like structure anymore, only for some who decide to use it like that.

This means folders would be an additional concept.

[Monviech (Cedrik)]

Just linking this here, its a POC that uses the new tabulator implementation of 25.7:

https://github.com/opnsense/core/pull/9015

[Seimus]

Just linking this here, its a POC that uses the new tabulator implementation of 25.7:

https://github.com/opnsense/core/pull/9015

When ones dream comes true :D

[Monviech (Cedrik)]

Thanks, the branch is pretty far now implementation wise. Its quite simple, and also optional with an additional button that can toggle that view.

Im sure it will soon be ready to try in a development version.

[Seimus]

Honestly, the fact you baked it like nothing as POC is impressive.

Regards,
S.

[Monviech (Cedrik)]

Its in the latest master now if somebody wants to play around with it.

Whats great is that there is essentially no micro management with folders, they are entirely automatic based on category and rule position.

Also the view is entirely optional, you can toggle in and out of it inline.

Im sure some small tweaks will still be necessary but overall it works surprisingly well.

[franco]

Oh, on, nobody is doing the simple work of replacing an entire UI grid framework in order to write a few lines of code to do something better than rule separators with the current categories.

Next up: the simple work of privilege separation being a hard default in 26.1.


Cheers,
Franco

PS: Too soon?

[ivica.glavocic]

Thanks, the branch is pretty far now implementation wise. Its quite simple, and also optional with an additional button that can toggle that view.
Im sure it will soon be ready to try in a development version.

Excellent. I showed it to the responsible guys in those 2 companies I mentioned before, they loved it, no more objections for the implementation od OPNSense with support as their edge firewall. I guess they will wait until this feature is in official release, but that's it. Great work.