pfSense

Additional finding is that the rules are not applied properly when you select an interface group as one of the selections (not sure if these should be an option).

Corrected the interface selector initial values for floating rules.

I Upgraded to 20151128-2200 and this is what I noticed:

1. The correct interfaces are now selected by default on Floating rules, so that is fixed.
2. The interface selection is now missing the "Interface Groups" and this is true for all floating and non-floating rules, which means you can no longer edit/create rules for "Interface Groups".
3. The first limiter is still selected instead of "None"
4. The saved floating rules are still not working, which I will open up a separate bug for.

Thanks,

Robbert

Found a couple more things and don't think this needs a new bug report after all.

1. The option under Quick: "Apply the action immediately on match." does not save.
2. There is a "Floating" section whithout any options.

I think #1 is actually causing my floating rules not to function. My two rules are below, the first one I edited in the interface and second I have not touched, the only difference is that the quick option is not saved.

<filter>
        <rule>
            <id/>
            <tracker>1422128822</tracker>
            <type>pass</type>
            <interface>opt3,opt4,opt5,opt9,opt10,opt11,opt12,opt13,opt14,opt15,opt16,opt17,opt18</interface>
            <ipprotocol>inet46</ipprotocol>
            <tag/>
            <tagged/>
            <direction>any</direction>
            <floating>yes</floating>
            <max/>
            <max-src-nodes/>
            <max-src-conn/>
            <max-src-states/>
            <statetimeout/>
            <statetype>keep state</statetype>
            <os/>
            <protocol>tcp/udp</protocol>
            <source>
                <any/>
            </source>
            <destination>
                <address>Server_DNS_Resolver</address>
                <port>53</port>
            </destination>
            <descr><![CDATA[Allow all clients access to Internal DNS Resolvers]]></descr>
            <vlanprio>0</vlanprio>
            <vlanprioset>0</vlanprioset>
            <created>
                <time>1422128822</time>
                <username>admin@192.168.1.10</username>
            </created>
            <updated>
                <time>1448814945</time>
                <username>admin@10.1.0.177</username>
            </updated>
        </rule>
        <rule>
            <id/>
            <tracker>1423429022</tracker>
            <type>pass</type>
            <interface>Servers,opt4,opt5,opt6,opt7,opt8,opt9,opt10,opt11,opt12,opt13,opt14,opt15,opt16,opt17,opt18</interface>
            <ipprotocol>inet46</ipprotocol>
            <tag/>
            <tagged/>
            <direction>any</direction>
            <quick>yes</quick>
            <floating>yes</floating>
            <max/>
            <max-src-nodes/>
            <max-src-conn/>
            <max-src-states/>
            <statetimeout/>
            <statetype>keep state</statetype>
            <os/>
            <protocol>tcp/udp</protocol>
            <source>
                <any/>
            </source>
            <destination>
                <address>Server_Time</address>
                <port>123</port>
            </destination>
            <descr><![CDATA[Allow all clients access to Internal NTP Server]]></descr>
            <updated>
                <time>1423429022</time>
                <username>admin@10.1.0.194</username>
            </updated>
            <created>
                <time>1423429022</time>
                <username>admin@10.1.0.194</username>
            </created>
        </rule>

I can confirm this if I look at /tmp/rules.debug using the tracker numbers from the config.

[2.3-ALPHA][admin@gw.to.sestary.eu]/tmp: cat rules.debug | grep 1422128822
pass on { em2 em1 em3 em4 em5 em6 em7 em8 em9 em10 em11 em12 } inet proto { tcp udp } from any to $Server_DNS_Resolver port 53 tracker 1422128822 keep state label "USER_RULE: Allow all clients access to Internal DNS Resolvers"
pass on { em2 em1 em3 em4 em5 em6 em7 em8 em9 em10 em11 em12 } inet6 proto { tcp udp } from any to $Server_DNS_Resolver port 53 tracker 1422128822 keep state label "USER_RULE: Allow all clients access to Internal DNS Resolvers"
[2.3-ALPHA][admin@gw.to.sestary.eu]/tmp: cat rules.debug | grep 1423429022
pass quick on { Servers em2 em1 em3 em4 em5 em6 em7 em8 em9 em10 em11 em12 } inet proto { tcp udp } from any to $Server_Time port 123 tracker 1423429022 keep state label "USER_RULE: Allow all clients access to Internal NTP Server"
pass quick on { Servers em2 em1 em3 em4 em5 em6 em7 em8 em9 em10 em11 em12 } inet6 proto { tcp udp } from any to $Server_Time port 123 tracker 1423429022 keep state label "USER_RULE: Allow all clients access to Internal NTP Server"
[2.3-ALPHA][admin@gw.to.sestary.eu]/tmp:

Thanks for the thorough report and the text file. That will really help. This file was converted to Bootstrap early on in the project and I think a lot has been learned since then :)

I'll look into the items you have listed here later today.

A typo prevented the IF Groups from loading, the "Quick" input had the wrong name, and the wrong array type was being used for the limiters. (A simple array was being used when an associative array of options => values is required.)

Hopefully this will work better for you. Please let me know.

Applied in changeset 0cdfe420e05f6fa40901eb23b2c1c9d50d9b1428.

I am checking with the 2.2 devs, but from what I can see the code in 2.2 more or less works by accident :) When the file was converted to bootstrap it was replicated in a way that no longer worked.

I have made some changes that I think may correspond to what was originally intended. Let me know if it helps please.

Applied in changeset 66066eda36fedf4df73bf03c6603ea76f9813327.

That seems to have done it! The floating rules save/apply properly and the default selection for the in/out,quick and interfaces is correct.

Thanks!