Feature Request : Firewall Rules

[bigops]

As the 26.7 version has started to take the definitive steps to decommission the old firewall rules I finally decided to migrate most firewalls into the new rule-set.  The migration went ahead without much issues but after the migration found that some connections which had been working for years started failing.  Investigating further it appears that the migration assistant doe not really care of the processing order of the rules when migrating. 

To capture all blocks for further troubleshooting the approach adopted earlier was to have an explicit block at the end of each interface firewall rule.  During troubleshooting it was observed that the migration assistant had put some rules of the interface after a block all rule on the interface.  This resulted in the catch all block rule denying access.  So had to manually move rules around so that rules for each interface are grouped together rather than in mix.

While troubleshooting I also felt that if we have a column which shows the rule number which lists the processing order it would be helpful especially when all the rules are now bunched together.

[nero355]

While troubleshooting I also felt that if we have a column which shows the rule number which lists the processing order it would be helpful especially when all the rules are now bunched together.

I am pretty sure you can Enable that Column within the new Firewall Rules and also Disable exisiting ones : Click around a bit! ;)

[pfry]

Not what you're asking for, but I always verify my rules in "Firewall: Diagnostics: Statistics" -> "rules".

[bigops]

While troubleshooting I also felt that if we have a column which shows the rule number which lists the processing order it would be helpful especially when all the rules are now bunched together.

I am pretty sure you can Enable that Column within the new Firewall Rules and also Disable exisiting ones : Click around a bit! ;)

Not sure where you found that option.  The only columns that I found was ID and sort order and sequence.  Both are not really helpful.  Is there something that I am missing? 

A serial number of firewall rules would go a long way to quickly identify the position of the rule on the firewall table

[nero355]

While troubleshooting I also felt that if we have a column which shows the rule number which lists the processing order it would be helpful especially when all the rules are now bunched together.

I am pretty sure you can Enable that Column within the new Firewall Rules and also Disable exisiting ones : Click around a bit! ;)

Not sure where you found that option.  The only columns that I found was ID and sort order and sequence.  Both are not really helpful.  Is there something that I am missing? 

A serial number of firewall rules would go a long way to quickly identify the position of the rule on the firewall table

When I add the column Sort Order it perfectly matches with : https://docs.opnsense.org/manual/firewall.html#processing-order

Or are you looking for something else ?

[bigops]

Initially I was thinking the same.  But then I came across this in the documentation

The Sequence does not have to be unique, multiple rules can share the same number. Though what this means is that the filter is not populated as strictly in order as if all rules have a unique sequence.

So I don't think it is a reliable way to identify the processing order??

[Monviech (Cedrik)]

It is very reliable to go by the sequence number because when you add rules and move rules it will always try automatically to keep all sequence numbers unique and spaced out.

The same sequence number behavior is still there for API users since some workflows depend on it. And of course if you want to manually take control of the sequence, in advanced mode of a rule you can always change it.