trouble using port alias

[benoit.lorand]

Hi,

I'm using opnsense community edition 21.7.7

I have discovered recently that some connexion are allowed by one rule who should not be use.
After some research, i found that when i link an alias for destination ports, this rule seem to be used in diagnostics/session.

Is there anyone who already see this ?

Best regards,
B LORAND

[benoit.lorand]

For information, i'm using port's alias to specify multiple port for one or more firewall rules.
Rules thats are faulty applied also have source filter on only some ip. But they match also other.
I have just trying to disable rule optimisation but they are faulty apply again.

[Fright]

could you give a specific example please?

[benoit.lorand]

Hi Fright,
Thanks about your interest for my case.

First of all, here my OPNSense version. Notice that i already had this mistake in previous version.



Here the rule that match.



Here aliases that are used by that rule.


Admins_Hosts is a network group that contain other hosts aliases. So here is the result :



And here what i see in session under Diagnostics. Notice that Source IP and destination port match nothing.


If you think to another information that could help for diagnose this problem. You can ask me for.
Thanks

Benoit LORAND

[benoit.lorand]

Another thing, currently i just remove the destination port alias by setting protocols to "any" and it's working (not like i want because all port but it's better than having some traffic allow instead of deny).

[Fright]

Hi
in the "sessions" screenshot i see that the sessions are quite old. in such a case, it is likely that these sessions (states) were established before the rules reordering or rules change. and PF does not update the rule numbers in the state tables in response to changes in the order of the rules or their parameters (so rule number in "pf -vvss" output will point to the "wrong" rule - the rule number that created this state at the time the connection was created)
in order to accurately see changes in the behavior of the PF in response to rule changes, it is necessary to observe new connections in the live log (Firewall: Log Files: Live View) and (or) delete old states, wait for new connections (if any) and then they can be seen on the sessions page with actual rules references.

issue persist if you follow this procedure?

[benoit.lorand]

Hi,

I think you are right.
Is it possible that scheduled rules change the rules reordering also ?

Best regards,
B LORAND

[Fright]

Hi

Is it possible that scheduled rules change the rules reordering also ?

not sure I understood the question correctly. scheduled rules are regular rules that switched to "disabled" when out of schedule (with or without corresponding states kill. based on Firewall: Settings: Advanced#Schedule States setting). so some rule numbers will change after enabling or disabling scheduled rules.