Skip to content

Network objects

Network objects, under Building blocks in the device menu, are reusable pieces referenced by rules and NAT, instead of repeating addresses in each one. Change an object once and every rule that names it follows. See Objects in rules for how they are used and what they become in pf.

The page has four tabs: Hosts & networks, Services, Groups and Schedules.

Naming

An object's name becomes a pf table, so it accepts letters, digits and underscores only. Names must be unique across all four tabs.

Hosts & networks

  1. Click + Add host / network.
  2. Fill in:
    • Name, e.g. web_srv
    • Type — Host, Network, Port or Hostname
    • Value — comma-separated: addresses or CIDRs, ports for Port, DNS names for Hostname
    • Description
  3. Click Save.

A Hostname object holds DNS names that the device resolves and keeps up to date, for a supplier who publishes a name rather than addresses. The form refuses:

  • wildcards (*.example.com) — the hosts behind a wildcard cannot be listed; ask the supplier for addresses or ranges
  • addresses — use a Host or Network object instead
  • names with no domain part

Services

A named protocol and port, so a rule can say ssh rather than tcp/22.

  1. Click + Add service.
  2. Fill in Name, Protocol and Ports (comma-separated; ranges use a colon, e.g. 10000:20000).

Choose a service in a rule's Service object field. The rule takes its protocol and destination port from it.

Groups

A group collects other objects, including other groups.

  1. Click + Add group.
  2. Fill in Name and Members (comma-separated object names).

The table shows What this group expands to on the device, because groups are flattened when the configuration is generated. A group that would contain itself is refused: this would create a loop: {path}.

Schedules

A time window that a firewall rule can be bound to.

  1. Click + Add schedule.
  2. Fill in Name, Start, End and Days (select none for every day).

If the end is at or before the start, the window runs past midnight: overnight — ends the next day.

Bind schedules to pass rules only

A rule bound to a schedule only exists while the window is open. A block rule bound to a schedule would disappear outside its window and stop blocking. Use pass rules and let the default deny cover the rest of the day.

Choose the schedule in the rule's Schedule field on Security policy.

Where an object is used

The Used column shows unused or in {count} place(s). Click it to see each Firewall rule, NAT rule or Group that names the object, with Open Policies.

An object in use cannot be deleted: Still referenced — remove it from the rules that use it first.

Changes follow the usual Apply Changes / Confirm cycle.