Missing firewall rules

[darth-aragoth]

Hi, I noticed that somy of my firewall rules are missing. In log I found, that there are duplicate filter rules. I checked them, these rules are the same, but are valid in different time ranges. You can try adding following rules to Mikrotik:

/ip firewall filter
add action=drop chain=forward comment="Block traffic 23-24" src-address-list=SomeList time=23h-1d,sun,mon,tue,wed,thu
add action=drop chain=forward comment="Block traffic 00-06" src-address-list=SomeList time=0s-6h30m,mon,tue,wed,thu,fri

Both rules are active in different time ranges, but have the same "uniq-id", so they are ignored and not loaded.

[tomaae]

That is intended behaviour. You need them to have uniqid, otherwise HA cant work with them.

[darth-aragoth]

I understand, that they should have unique ID. In Mikrotik firewall, there are two separate and diffferent rules, that won't load to HA because of duplicate error. 'time' setting makes them different, maybe it could be added to 'uniq-id' (when set) and it would make the rules unique and HA could load them?

[tomaae]

we cannot have everything in uniq-id, time is too rarely used for that. adding new variable to it is also a breaking change. just add one of the unique-id parameters to one of them so they are different.

[darth-aragoth]

Is there any description-type parameter, that won't change firewall behavior? Can I somewhere find list of parameters used to build uniq-id?

[tomaae]

for filter its following

                    {"name": "uniq-id"},
                    {"action": "combine"},
                    {"key": "chain"},
                    {"text": ","},
                    {"key": "action"},
                    {"text": ","},
                    {"key": "protocol"},
                    {"text": ","},
                    {"key": "layer7-protocol"},
                    {"text": ","},
                    {"key": "in-interface"},
                    {"text": ","},
                    {"key": "in-interface-list"},
                    {"text": ":"},
                    {"key": "src-address"},
                    {"text": ","},
                    {"key": "src-address-list"},
                    {"text": ":"},
                    {"key": "src-port"},
                    {"text": "-"},
                    {"key": "out-interface"},
                    {"text": ","},
                    {"key": "out-interface-list"},
                    {"text": ":"},
                    {"key": "dst-address"},
                    {"text": ","},
                    {"key": "dst-address-list"},
                    {"text": ":"},
                    {"key": "dst-port"},
                ],

[darth-aragoth]

Thank you for support.