pfSense

Screenshot of rules attached.

To whom it may concern,

I have also encountered this bug as documented in this NetGate forum thread:

"https://forum.netgate.com/topic/152824/sg-5100-udp-states-still-alive-after-schedule-expires-2-4-5-release-amd64"

The information I present on that thread shows that LAN side states spawned under the user created pass by schedule rule ARE terminated when the schedule ends, but the matching state on the WAN side (outbound to the internet) does not.

Then the firewall itself creates a matching state into the LAN from the WAN side so that traffic continues to flow both directions for that set of states.

This is not expected and in my opinion very bad behavior. If the matching state on the WAN side is manually deleted (or deleted via a cron task), then as expected the traffic ceases for that LAN state.

Attached are a series of files that should show the issue.

The UDP states show clearly that the WAN side state was spawned by a rule outside the pass by schedule user rule and survives the expiration. What is unexpected is the spawning of a new state from the WAN to the LAN by a Firewall rule.

In my opinion, when the schedule expires, the states spawned by the rule and their counterpart on the WAN interface should be killed.

Please contact me if you need further information.

Phizix

Duplicate of #8820