can netwatch trigger a firewall rule?

Spirch · Fri Sep 21, 2018 3:35 pm

I got a hAP ac and cAP ac

each one have this specific netwatch rule

hAP:


add host=192.168.175.125 interval=5s 
    down-script="/interface wireless set interface-WLAN1 disabled=no /interface wireless set interface-WLAN2 disabled=no" 
    up-script="/interface wireless set interface-WLAN1 disabled=yes /interface wireless set interface-WLAN2 disabled=yes"

cAP:

 
add host=192.168.75.1 interval=5s 
       down-script="/interface wireless set interface-WLAN1 disabled=yes /interface wireless set interface-WLAN2 disabled=yes"
       up-script="/interface wireless set interface-WLAN1 disabled=no /interface wireless set interface-WLAN2 disabled=no"

some how I think this firewall rule

add action=accept chain=ICMP comment="Accept ICMP Echo request - Avoiding Ping Flood" icmp-options=8:0 limit=1,5:packet protocol=icmp

is being triggered, i'm seeing ICMP block and the script is being activated and I lose connection

I didnt expect netwatch to "flood" since it is set to 5sec

is that normal?

sindy · Fri Sep 21, 2018 4:58 pm

What you've set using limit=1,5:packet is a limit of not more than 1 packet per second where 5 packets may come initially and still be accepted. If the idea was to permit one packet every 5 seconds, the correct syntax is limit=1/5s,1:packet.

Every interval, netwatch sends icmp echo requests 1 second apart until the first response arrives or until 3 requests are sent, whichever happens first. So to stay safe even if the netwatched destination doesn't respond, you need limit=3/5s,3:packet

The fact that your current rule matches when the netwatched destination does respond is correct - limit matches on packets which fit into the limit, not on packets which exceeed it.

Spirch · Fri Sep 21, 2018 6:21 pm

What you've set using limit=1,5:packet is a limit of not more than 1 packet per second where 5 packets may come initially and still be accepted. If the idea was to permit one packet every 5 seconds, the correct syntax is limit=1/5s,1:packet.

Every interval, netwatch sends icmp echo requests 1 second apart until the first response arrives or until 3 requests are sent, whichever happens first. So to stay safe even if the netwatched destination doesn't respond, you need limit=3/5s,3:packet

The fact that your current rule matches when the netwatched destination does respond is correct - limit matches on packets which fit into the limit, not on packets which exceeed it.

thanks for the explanation, I tweaked the rule and I will see if I have any issue

can netwatch trigger a firewall rule?

can netwatch trigger a firewall rule?

Re: can netwatch trigger a firewall rule?

Re: can netwatch trigger a firewall rule?

Who is online