Project

General

Profile

Actions

Bug #4651

closed

Policy route negation rules receive the same tracker ID as the rule they are based upon, which confuses the log parser

Added by Jim Pingle over 6 years ago. Updated over 6 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Ermal Luçi
Category:
Rules / NAT
Target version:
Start date:
04/23/2015
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.2
Affected Architecture:
All

Description

If the policy route negation rules are active, the automatic negation rule receives the same tracker ID as the rule it is based upon:

pass in quick on $LAN inet proto tcp from any to <negate_networks> tracker 1429792471 flags S/SA keep state label "NEGATE_ROUTE: Negate policy routing for destination"
pass in quick on $LAN $GWttest inet proto tcp from any to any tracker 1429792471 flags S/SA keep state label "USER_RULE: negate check test"

Since the tracker ID is the same and it comes first in the ruleset, when set to log, the logs show the negate rule as passing the traffic when that is not the case.

Actions #1

Updated by Ermal Luçi over 6 years ago

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100
Actions #2

Updated by Ermal Luçi over 6 years ago

Actions #3

Updated by Chris Buechler over 6 years ago

  • Status changed from Feedback to Confirmed
  • Assignee set to Ermal Luçi

the tracker on negate rules always ends up as "1" now.

Actions #4

Updated by Ermal Luçi over 6 years ago

  • Status changed from Confirmed to Feedback

Just a global correction.

Actions #5

Updated by Ermal Luçi over 6 years ago

Actions #6

Updated by Ermal Luçi over 6 years ago

Actions #7

Updated by Chris Buechler over 6 years ago

  • Status changed from Feedback to Resolved

fixed

Actions

Also available in: Atom PDF