From 1.1.32, Firewall › Auto rules suggests changes to your rules from the firewall's own evidence, and offers ready-made rules (templates) for common needs. Everything here is a draft: nothing changes until you review it and commit. You see each draft in the rule flow (See your firewall rules as a live flow) as Preview before you apply it.
From 1.1.33 the top suggestions also appear on Firewall › Rules, between the rule flow and the table: up to three, high risk first, one line each with Why?, Preview and Dismiss. Review suggestions opens this page with the full cards. Auto rules next to Add rule opens it too. The templates are also the actions under What would you like to do? on the Rules page, asked one question per screen (see See your firewall rules as a live flow).
At the top: how much evidence there is, per kind:
Suggestions (label Suggested), each with the evidence in numbers and dates:
| Kind | What it found | What it offers |
|---|---|---|
| Redundant | an earlier rule already handles all of this rule's traffic the same way | turn the rule off |
| Never matches | the rule can match no packet (for example IPv4 sources with an IPv6 destination) | turn it off |
| Never wins | an earlier rule with another action decides all of its traffic | move it above that rule |
| Unused | an allow rule with no traffic for the whole period | turn it off (never deleted) |
| Narrow | a broad allow (any destination or service) used only for a few destinations/services | a narrow rule above it; after it has run a week with the broad rule unused, a second card offers to turn the broad one off |
| Blocked by your rule (was Often denied) | many connections from your own devices blocked by one of your deny or reject rules (with logging on) | nothing to do: your rule is working. Allow anyway adds a narrow allow above it (high risk: it overrides your rule) |
| Inbound | many connections from the internet blocked | information: this is expected background scanning. Lists the busiest addresses with owner and country; Block it blocks them completely |
| Risky | any-any, or an internet-open rule | the narrower replacement, or turn it off |
Risk: High for anything that opens traffic from the internet, any-any, management services of the firewall, or turns a deny rule off; Medium for broad outbound rules; Low otherwise. High-risk drafts ask for an extra confirmation.
From 1.1.35, when one of your own rules blocks your devices many times, the card says so plainly, so it is not mistaken for an attack. For example, a YouTube night block for the TVs and phones (a rule with the schedule midnight to 5 am) blocks every YouTube connection they try at night:
There is nothing to do; press Dismiss to hide the card. Allow anyway (with Preview allowing) is still there for traffic your rule should not block; it is high risk because it makes an exception to your rule. On the Rules page these cards come after the real suggestions, with Why?, Show rule and Dismiss.
Who an address belongs to (owner and country) comes from the country and network-owner data under Firewall › Geo filter (DB-IP, downloaded when you ask for it). Until it is downloaded the cards say Owner and country unknown and where to get it. The host name (for example youtube.com) comes from the host names in your own rules.
The Inbound card (many connections from the internet blocked) explains that this is ordinary background scanning, not a targeted attack, and lists the busiest addresses with their flag, owner and country and how many times each tried. These connections were already blocked. Block it goes further: it adds those addresses (up to ten) to Firewall › Geo filter, which drops them before any rule, port forward or service of the firewall. It turns the geo filter on (a filter that was off then covers both directions; one already in use keeps its direction) and opens Review and commit. Remove an address there to undo it.
Ready-made rules with your real zones, objects and services:
Choose the values and press Create draft. The firewall checks the draft against your pending changes (conflicts, rules it would shadow, existing coverage), places it where it takes effect (a block goes above the rules that would allow it), and names it automatically.
Automatic names follow ACTION | FROM | TO | SERVICE | PURPOSE, for example DENY | ANY | ANY | TELNET | BLOCK_SERVICE, at most 63 characters, unique (a number is added when needed), and you can change them. The description says how the rule was made.
The pictures are from the test firewall (versions 1.1.32 to 1.1.35).