How reliable is Firewall:Diagnostics:States for troubleshooting

[DaElephant]

I ask this question because I am seeing odd behaviour there.

I have 2 IP addresses in the same subnet, .5 and .50
The .5 address is matching on the firewall rule that has .50 in it, not .5.  The .5 IP should match a rule further down the rules list for that subnet.

I cleared the state table but the exact same issue came back.


Side note
Another odd thing in Firewall:Diagnostics:Aliases it is listing Aliases that no longer exist.  They did exist at one point but have been deleted or renamed, but still show.

[Patrick M. Hausen]

Show the rules, please. Educated guess: you have the netmasks/prefix-lengths wrong so the rule matches more than intended. To match a single IP address use /32.

[pfry]

[...]The .5 address is matching on the firewall rule that has .50 in it, not .5.  The .5 IP should match a rule further down the rules list for that subnet.

I cleared the state table but the exact same issue came back.

It's possible you've encountered a bug (either in rule evaluation or state display), but chances are you've got a rule logic error. We'd need to see the relevant information (rules, aliases, state display, etc.) to be sure. Putting the data together might reveal the issue (or not).

[...]Another odd thing in Firewall:Dianostics:Aliases it is listing Aliases that no longer exist.  They did exist at one point but have been deleted or renamed, but still show.

I'd assume that's because pfctl will show the (now-) empty tables, but I'd have to test it to be sure.

[DaElephant]

Is this what you are looking for?

These are the 3 rules on the interface
You cannot view this attachment.

These are the aliases
You cannot view this attachment.
You cannot view this attachment.

This what shows in states table
You cannot view this attachment.

[DaElephant]

It does follow the correct rules some times.
You cannot view this attachment.