Problems with floating rules after upgrade to 26.7

[ivoruetsche]

Hi

After we updated to 26.7 we struggling with floating rules.

So for example, we have a rule where allowing remote networks via IPSec to internal networks as interface rule and another role where deny all traffic to other subnets as floating:

Floating rule:
Interface: nothing selected
Quick: false
Action: Block
Protocol: *
Source: *
Port: *
Destination: alias_all_int (as subnet alias 10.16.0.0/20)
Port: *

Interface rule:
Interface: IPsec encapsulation
Quick: true
Action: Pass
Protocol: *
Source: alias_net_ipsec_dest3 (as subnet alias 172.27.9.0/24 192.168.2.0/24 192.168.42.0/24)
Port: *
Destination: *
Port: *

• Before upgrade it went fine
• After upgrade, the first rule (floating) matches and blocks all traffic
• After disabling, an automatic generated (default blocking) rule blocks the traffic, so enabling again...
• I removed the "IPsec encapsulation" from the interface list, so it moves up to the floating rules, i moved it before the blocking rule -> still blocking the IPsec traffic
• Rebooting the FW -> now, the right rule is taken and the traffic is accepted
• Moving rule back as interface rule ("IPsec encapsulation"), still running fine
• FW reboot -> The blocking rule wins and the traffic is blocked again
• Snapshot restore to 26.1.11 -> Everything is working again

So I think, there is something where goes wrong in 26.7. Maybe interesting: We started with this FW with 26.1 and worked from beginning on with "Firewall > Rules [new]", nothing was edited or added in "Firewall > Rules"...

Ivo

[userfw]

Floating rules are processed before interface rules, it's expected behaviour: https://docs.opnsense.org/manual/firewall.html#processing-order

They didn't change with 26.7, but it's different between legacy and "new" rules.

[Bob.Dig]

Floating rule:
Interface: nothing selected

This makes no sense to me to begin with.

[Patrick M. Hausen]

This makes no sense to me to begin with.

In the old system this meant "all interfaces". You can still select "any" in the new system.