If you're new to OpenSense, one area that might be a bit confusing or challenging at
first is understanding how firewall rules work. I know it took me a little bit of time to wrap my mind around it because I was new to it
In this video, I'm going to focus on the rule order and how rules are processed in OpenSense
to help clear up any confusion you may have. Before we start creating the actual rules themselves in a future video, I'll explore
creating the actual firewall rules in more detail. In this one, I'm going to focus on just the rule order and how things are processed in OpenSense
I think it's important to understand that before you start writing the rules so then
you know where to create rules and then you might want to create rules in different areas
I've selected one of my V-Lan interfaces in the firewall rules section to demonstrate
the order that rules are processed in in OpenSense. As you can see, I have two basic firewall rules on this interface that allows internet-only
access for this network. OpenSense, a few versions ago, updated their interface to better show how the order of
the firewall rules are executed, which I like a lot because it's easier to visualize what's
happening before these rules get executed. As you can see, there are automatically generated rules, which this was here a while ago, but
they've added the floating rules and the group rules. Starting with automatically generated rules, you'll see these are all the rules that OpenSense
creates automatically for you for every network. These are rules you can't really change and it's based on some of the configuration options
that you select. Like if you're using IPv6, it's going to enable some of these IPv6 rules that are required
for the network to function properly. These rules, you generally aren't concerned about too much because you would really need
most of those to have a properly functioning network. Then comes the floating rules
Floating rules occur before any other rules that you have on your network
You can define these under the rules section or the floating rules category that you can
create these rules. You can see I have a few in here
These are actually good for when you want to block a network-wide, block lists and that
sort of thing. You can add in there in the floating rules section. Then next is group rules
You'll see I have some group rules here to redirect DNS and NTP from a local DNS and
NTP service. These rules apply after the floating rules but before the rules for your interface
Spiral groups allow you to group multiple rules together that you want to apply across
multiple interfaces so you don't have to repeat yourself. If you want to change that access later, it's nice to be able to do it in one place
You'll see that you've got automatic rules and then the floating rules and then the group rules, which only apply to specific interfaces in that group that you selected
Finally, it'll do the interface rules like this interface here that's called security
These rules get applied last. Within each section, the rules are processed in order from the top to the bottom
Whenever traffic matches that rule, the network traffic for that rule will be either allowed
or denied based on what you have in that rule. Once it hits this rule, it won't process any other rules
If this rule allows access to here, it doesn't go ahead and execute the rule below it
It just stops right there and then it'll process the next packet
You can override this behavior, as you can see, by default, it's first match
When you go to edit this rule, I'm going to go to edit real quick, you can change this
to be apply the action immediately on match. You can uncheck this so that it'll go to the next rule and process it
Most of the time, you want to have it apply on the first rule that matches because otherwise
you're not getting some same scenarios. It'll be hard to troubleshoot and figure out what's being allowed and blocked because it's
passing through certain rules. It's better to do it the first rule wins
It's a little bit easier to understand, I think. There might be some scenarios where this apply action immediately on match to disable
It might be useful. I haven't actually found a case in my network to be able to use that effectively
To me, it just makes it seem like a little more confusing to understand certain rules
and then to skip. That is an option to change the default behavior of the rule if you need to, but I recommend
just reading it as a default where it's always checked so the first rule that matches the
traffic in your network wins. That way, you know it's going to be immediately allowed or immediately denied
I hope this helps you understand how the rule order works in OpenSTEM
When you go to create rules, which I'll go into more detail later, that you'll understand
when your rules are fired and what order they're in because once you start getting
into the details on how to actually implement rules, that's going to become very important
because you want to make sure you want your rules in the proper order. If you have them out of order, you're going to either allow or deny things that you don't want
In general, I would recommend doing more specific rules first to more broader rules at the bottom
because that's going to be your allow or deny type thing. One thing to note that I didn't mention yet is if you didn't have any rules on this interface
it basically defaults to deny all. In OpenSTEM, if you don't have any rules in there, you're basically creating an isolated
network that cannot communicate to the internet or any other network on your network
That actually can be useful if you, say, have an IP camera network and you don't want it
to access the internet. That's one example where you might want to have minimal amount of firewall rules or nothing
because you can take advantage of that deny all. I hope this helps you get a better understanding of how the rules are processed and what order
they're processed in. When you go to create your firewall rules, you'll be ready to go knowing that the order
of the rules are important and knowing that it starts with the automatic rules and the
floating rules and the group rules and then the interface rules. It goes from the top to bottom and then whichever rules match first is the one that's going
to win, whether it's allowing or denying the traffic. Until next time, you have a good day
Bye