I have a firewall I run for a customer that has several systems behind it. They have a lot of individual ports they need open to the systems from many individual IPs. I actually have 2852 rules on the firewall. I am currently running it on a Smoothwall Express, and it is working. However, I want to migrate to IPFire. However, when I load that many rules, it no longer allows me to get to the web gui or open any new SSH requests to it. I recall having to change a timeout variable in Smoothwall (under /usr/lib/smoothwall/smoothd.pm) to add a large amount of rules. Would there be something equivalent to that in IPFire? I am editing the /var/ipfire/firewall/config with the rules, then running /usr/local/bin/firewallctrl for which I receive no errors. I have tried adding the rules, then rebooting. I have also tried loading 50-100 rules at a time, but it eventually causes the no connectivity issue. I am running on a system with 4 CPU, 16B Memory, and 500GB SSD drive. Is IPFire capable of running this many rules?
I know this is a difficult process, but I would start by taking an inventory of the rules on the existing firewall.
First, I would check if all the rules are actively used (rule hits).
Then I would use groups for source, destination, and ports.
In my opinion, a firewall with so many rules is poorly managed.
If 25 people with different IPs need to get to 10 different network ports on 10 different servers, you have 2500 rules. I guess I don’t understand how creating groups and referencing those groups would cut down on this much. I can check to see which ones are actively used, but this firewall is dedicated to a customer. They requested the ports and IPs, and if they end up trying to use one that is no longer there, they will call me on it and question why it isn’t setup.
I’m wondering if there is some sort of timeout happening as it is loading the rules into iptables, which leaves it in a crashed state.
I don’t see any reason why loading 2,500 rules should take that long.
Please enable debug mode in /usr/lib/firewall/rules.pl:
// /usr/lib/firewall/rules.pl
28: require "${General::swroot}/location-functions.pl";
29: require "${General::swroot}/ipblocklist-functions.pl";
30:
31: my $DEBUG = 1;
32: # Set to one to enable debugging mode.
33:
34: my $IPTABLES = "iptables --wait";
35: my $IPSET = "ipset";
Then run:
/usr/local/bin/firewallctrl 2>&1 | tee /tmp/out
This will allow us to see what is happening while your firewall rules are being loaded and identify where the delay occurs.
After going down a rabbit hole for a couple days, I finally figured out what was actually causing my issue. I am migrating from Smoothwall. On that system, when the source port and destination port are the same, it puts a “0” for the destination port. So you would have something like 443 as the source and 0 as the destination in the rule file. When I converted the rules for IPFire, I didn’t take that into consideration. Once I changed all the rules with ‘0’ to have the correct destination ports, everything is working fine.