Stateful firewall rules for pppoe connection

[himurae]

I was desiring to make some simple fw rules for pppoe connection, so that a return channel is automatically opened for the rule
@n.fort what changes i need to make ?? Since source address for pppoe is dynamic keeps changing

Stateful firewall without function?

Try: ## Accept new connections in one direction and drop everything else: set firewall ipv4 forward filter default-action drop set firewall ipv4 forward filter rule 1001 action ‘accept’ set firewall ipv4 forward filter rule 1001 source address ‘10.121.20.200/32’ set firewall ipv4 forward filter rule 1001 destination address ‘192.168.172.1/32’ set firewall ipv4 forward filter rule 1001 log set firewall ipv4 forward filter rule 1001 state new ## Accept established/related connections and drop in…

[blunden]

If you allow connections with state established or related if will automatically allow responses to connections you have initiated.

That’s what he did with the following global policy:

## Accept established/related connections and drop invalid
set firewall global-options state-policy established action accept
set firewall global-options state-policy related action accept
set firewall global-options state-policy invalid action drop

You can also do it with rules like these:

            rule 10 {
                action "accept"
                description "Allow established/related"
                state "established"
                state "related"
            }
            rule 20 {
                action "drop"
                description "Drop invalid packets"
                state "invalid"
            }