Zenarmor 1.10 MAC address for policy apply

[opnip]

Hi @mb,

thx for the possibility to match a policy by a client MAC address now.
But in my case it is not working. Defined a new policy with MAC addresses. But always the default policy would be assigned to the devices where the custom policy with the configured MAC address should match.

Update: It works now. I also had enabled the WireGuard interface before and one IP address configured. I removed  that IP address and the WireGuard interface. Now with only LAN and configured MAC addresses it works.

[athurdent]

Ah, I'm not alone then. Already filed a ticket a few hours ago. Same problem here.

[athurdent]

Thanks for the update, I also have 2 interfaces. I'll try removing one later, it's a normal one though, no special kind.

[opnip]

Its not the second interface (checked again). If I enable the WireGuard interface again, policy still matches.

It was the additional configured IP address for matching. Policy is matching only if I configure MAC addresses only.

[athurdent]

Odd, first thing I did before putting in the MAC address was deleting the IP of the device. I have a bunch of other IPs in that policy though. Do you have any additional IPs, or did you delete all IPs?

[opnip]

I deleted all IP addresses for now. Reported it as a bug in 1.10.

[athurdent]

Do you also get this one with only MAC addresses?

"Are you sure you want to proceed?
You've only selected interface but did not specify any other criteria for this policy."

[mb]

Hi @opnip,

Policy criteria are evaluated with the AND logical operator. It's not either IP addresses or MAC addresses, rather, if you specify both an IP address or MAC address they should both match. [1]

@athurdent, if you only enter MAC addresses that warning should not be displayed. We'll have a look at it. But you can ignore it, for now, its' a misleading warning message.


[1] https://www.sunnyvalley.io/docs/troubleshooting/policy-and-filtering#policy-does-not-seem-to-get-applied

[athurdent]

@mb, ah thanks I understand the AND logic now I guess.

If I enter my LAN IPv4 network AND the MAC address of a LAN host, then IPv6 packets do NOT get matched, because I failed to enter my LAN IPv6 network, too. Correct?
At leat that is how it works here, just tried. If I remove my LAN IPv4 network and leave the network/IP section blank, then it matches my test host's IPv6 traffic, because the only thing that needs to match for the rule to work is the MAC.

Its around 7:00 am here and my brain already logic-hurts a bit, hehe... :-)

[opnip]

@mb
Thanks for answering the topic.

With this understanding I restructured my zenarmor policies. In the end, I was able to implement what was important to me.

[mb]

@opnip, great to hear that!