Rule Separators

[Fright]

@chropnsense
no trouble )

draft is ready.
https://github.com/kulikov-a/rules/issues/2#issuecomment-1027656562

very interesting in speed assessment by guys with "tons of rules")

[litebit]

Hi,

I'm planning to migrate from pfsense to OPNsense.

I know this is an old topic, and I don't want to upset anyone, but I do have a question regarding this topic.
Me too, I would love to see some kind of separation, segregation between blocks of rules within an interface or group. Besides using that a lot in my pfsense, also in my professional life, all firewalls I worked with (Fortinet, Checkpoint, Fortinet, Juniper, ...) have one way or another to separate or group blocks of rules.

I already read that the OPNsense developers are unlikely to implement rule separation headers like in pfsense. I can understand most of the points they raised about this, but....

It seems to me, it is already possible (in a way)? Because I see exactly that, when looking at the line "Automatically generated rules"... it has all I would like:
- a set of rules grouped together
- can be collapsed/expanded

https://imgur.com/a/OKY2jYg

Is it not possible to open up that feature for when we add rules ourselves?

[mimugmail]

If its just about collapse you can try categories

[litebit]

If its just about collapse you can try categories

I tried that, but it is different ... how do I explain .... categories do not enforce or are not "inline" with the order of the rules. If you know what I mean?

[mimugmail]

I know what you mean. I for myself accepted, whether in closed or open source, you dont get every wish/feature implemented :)

[InstaNoodle]

Just wanted to say, that I'm about to embark on 170+ OPNsense installs each with lots of rules and this feature is sorely missing.

[chemlud]

https://forum.opnsense.org/index.php?topic=2851.msg87606#msg87606

It can be only a few lines of code ;-)

[fuskadoo]

Completely agree with "Anything that improves the readability and maintainability of firewall rules is not in fact 'non-functional' ".  It's the same reason the "automatically generated" rules are collapsed and out of view.  You just don't want to see those most of the time, but still need them.  I moved from pfsense in the last year, and love OPNsense, but honestly, I miss this ONE feature a lot.  It's just the pure organization visually, and ability to quickly find sections to make adjustments.

In the meantime I just create a disabled "fake rule" with a recognizable comment separator such as:

****************************** Rules for routing clients to VPN ********************************

and put those rules below it.  The only downside is that it's not collapsible.  I hope this can be available some day in the future, but completely understand that resources are limited.

Thanks for all the hard work on OPNsense.

[franco]

> Completely agree with "Anything that improves the readability and maintainability of firewall rules is not in fact 'non-functional' ".

Disagree. These are non-functional rules and to this day pfSense usually fixes some rule-separator-related bug in the GUI. Here's one just recently https://github.com/pfsense/pfsense/commit/e0a827cffc5 and I don't think dealing with constant fallout of cosmetics is worth it.

> It's the same reason the "automatically generated" rules are collapsed and out of view. You just don't want to see those most of the time, but still need them.

Kind of a bad example because we wrote that. The previous pfSense behaviour was not to show these rules at all. pfSense may have solved this nowadays, but I have no interest to double-check.

> I moved from pfsense in the last year, and love OPNsense, but honestly, I miss this ONE feature a lot.

One of the recurring feature request themes is exactly this: I moved but I really only need this one feature. I'm afraid this doesn't work out all the time. IMO you should switch because the bulk of the features is better, not because you liked the old wallpaper so much you want to bring it over to your new home.

Please remember, I'm not trying to be unfriendly. I merely want to share our side of the picture, because I feel it gets lost in the excitement and disappointment over trying something new.


Cheers,
Franco

[Patrick M. Hausen]

Collapsable and expandable groups would be fantastic, IMHO. Double bonus points for enabling/disabling and reordering entire groups. Triple bonus for hierarchical groups  ;D

Sidewinder had that and it is just awesome with very large rulesets.

Maybe after everything else is moved to MVC? Not going to file a feature request right now, I get your point.

My point is: separators are not nearly enough. Either groups or just live without.

[fuskadoo]

> Please remember, I'm not trying to be unfriendly. I merely want to share our side of the picture, because I feel it gets lost in the excitement and disappointment over trying something new.

Understand, and get it.  No unfriendlies taken at any time.  I also want to clarify that I didn't say "I moved and NEED this one thing", I simply said I really miss it.  ;)  Hearing the Dev side of it I can see why time hasn't been burnt on it, so thanks for sharing that.  But I still miss it.  :)

Regards and best

[franco]

I'll try to pass on the collapsible container idea for the categories in today's meeting. There are a couple of challenges regarding this but let's see what the consensus is.


Cheers,
Franco

[bimbar]

> Please remember, I'm not trying to be unfriendly. I merely want to share our side of the picture, because I feel it gets lost in the excitement and disappointment over trying something new.

Understand, and get it.  No unfriendlies taken at any time.  I also want to clarify that I didn't say "I moved and NEED this one thing", I simply said I really miss it.  ;)  Hearing the Dev side of it I can see why time hasn't been burnt on it, so thanks for sharing that.  But I still miss it.  :)

Regards and best

Most firewalls have pretty much the same feature set, the main differentiator for me is price and UI.
Now opnsense has a few additional features, and it is cheap, but still professionally we do fortinet for the better firewall rule UI.
IMO an opnsense ruleset with more than 20 rules is well on the way to be pretty much unmanageable.

[franco]

> but still professionally we do fortinet for the better firewall rule UI.

And the incentive to make it happen here is what?

We did discuss in the meeting but the bottom line is it won't help us overcomplicate the situation in static firewall pages that still need an MVC migration. Categories are flexible enough. Building containers from categories would actually put more restrictions on categories in terms of rule location and overlapping use.


Cheers,
Franco

[Patrick M. Hausen]

Want a demo of the Sidewinder UI in Dublin?