What is rule 4294967295 ?

johndoe102

Hello everybody,

I recently updated my Netgate 4200 with pf+ to 25.11-RELEASE.

When I check the Firewall System Logs, there are many blocked actions for rule 4294967295 ?

There are blocked firewall entries for some of the defined VLANs ... not all VLANs.
I couldn't find any firewall rule with this ID.

Can anybody explain to me what is this rule ?

Screenshot From 2026-01-09 00-21-33.png

Thank you
Tom

johnpoz

@johndoe102 there was this

https://redmine.pfsense.org/issues/12872

johndoe102

@johnpoz
FYI. I think I have found the reason for it (not a fix )

I did following:

Roll back using Boot Environments to an earlier known good state (Release 25.07.1)
Clear all System Log Files.
Reboot -> Firewall Logs is empty ... no strange entries with rule 4294967295
Install Release 25.11
Clear all System Log Files.
Reboot -> Firewall Logs contains strange entries, but without any rule ID
Apply following patches:
Clear all System Log Files.
Reboot -> Firewall Logs contains strange entries with rule ID 4294967295 ... and in one of the patches Fix firewall not matching PF rules with rule number 0 is probably the explanation

Bob.Dig

I get these (@4294967295) a lot.

The rule ID shown in the "post-patch" screenshot is the default ID used when a packet is dropped without a matching rule in the ruleset (e.g. due to a short packet error, IP option, etc.).

Gertjan

@johndoe102 said in What is rule 4294967295 ?:

rule 4294967295

That's $FFFFFFFF. Unsigned, that makes 4294967295.
If that's is a signed int, make that rule number -1 so an error being returned ?

pf is giving up on something ?

Uglybrian

I have also run across the same rule ID/ tracker value showing up periodically. Currently using 25.11 with KEA.
In case it matters to anyone, the rule will show up when i enable Nexus.

It also showed up on the on my port3_wifi segment.

I have a ICMP allow subnet to any.

After some investigation, I found if i changed the allow ICMP source from subnets to any. The rule
ID @4292967295 stopped logging.

My last IPV6 rule on the WIFI segment was a allow all subnet to any.

I guessing the there was something related between these two rules that was triggering it.
Im still reading upon it,slowly.

SteveITS

@Uglybrian ff02::16 is multicast.

FWIW we always disable logging for the default block rules, unless diagnosing something. There's a lot less noise, and disk writes.