Archive > 22.7 Legacy Series

Rule evaluation order of non-quick rules in the Floating Rules section

(1/1)

user-0209:
I was trying to put a rule for catching all out-of-state packets so that the Default Deny rule really and only lists/blocks illegitimate traffic. Put that rule also into the floating section right above the default Deny rule. After some testing I get the impression, that the non-quick rules get evaluated in reverse order (compared to how they appear in the list). Hence, if I place the Out-Of-State rule BEHIND the Default Deny rule, the Out-of-State will be sorted out and Default Deny is left for just the illegitimate traffic.

Can somebody confirm, this is by design? Thanks.

And: thanks for this great piece of software!

Fright:

--- Quote ---non-quick rules get evaluated in reverse order (compared to how they appear in the list)
--- End quote ---
(if i understand this sentence right) that's how pf works: for non-quick rules last matching rule wins.
or, to put it another way: in pf the last matching rule wins, and setting the 'quick' option makes the matched rule last

Navigation

[0] Message Index