Hi I wanted to know if there is an option with the firewall to add the equivalent of a deny an any at the bottom of the rule like on a cisco or a checkpoint firewall.

deny any any

action=drop

any, any

src-address

dst-address

any

chain=input

chain=forward

Hi Sindy

So if I was to put in a Action=drop chain=input at the bottom of the rules this would achieve that same thing as a deny any any.

Code: Select all

Also I just wanted to check:
(chain=input) is this for all traffic coming in to an interface of the router. and
(chain=forward) are for all those that originated from inside the router i.e. like when you do a (check update) for the latest software version.

• Code: Select all

  chain=input

  handles packets which end up at one of router's own IP addresses (after eventual dst-nat, so the packet's dst-address may have been a different one than router's own when it has arrived to in-interface, but the dst-nat changed that)
• Code: Select all

  chain=forward

  handles packets forwarded between router's interfaces (after eventual dst-nat, so the packet's dst-address may have been one of router's own ones when it has arrived to in-interface, but the dst-nat changed that)
• Code: Select all

  chain=output

  handles packets sent by the router itself.

Hi I wanted to know if there is an option with the firewall to add the equivalent of a deny an any at the bottom of the rule like on a cisco or a checkpoint firewall.
As I tried to add one at the bottom of the rule base and it blocked all traffic in and out of the firewall instead of letting all the other traffic that matched the rules above through.

I added a rule below on version (6.34.1)

chain=input action=drop src-address=dst-address=log=yeslog=yes

Code: Select all