Firewall rule sequencing.

[geoai777]

In my experience when I autoadd rules, soon whole firewall quickly goes out of hand. Especially when new app versions get released and there are Firefox.123, Firefox.124, Firefox.125 rules.
It would be convenient to have pre-defined rule sets. Like set of ports that are relevant to Firefox and apply to every version or browser.

Meanwhile I want to share how I organize my rules. There is a set of primary categories that define type of application and there is set of subcategories that define applied action.
For example: It is required to allow nslookup with normal priority, rule will look like: 10_70-nslookup-53

See full table of codes below:

app type rules:
00 - global: rules that apply to all apps. Used to block fishing, scam and other trash sites
10 - system communications: dig, nslookup, ping - slightly better priority than regular system apps
20 - system apps/utils: apt, clamav, kde
30 - services: ccp, cups - most apps that run in background
40 - high priority apps: rdesktop - low latency apps that we don't want to wait through other traffic
50 - normal priority frequent use: thunderbird, browsers
60 - normal priority apps: quemu, virtualbox, android-studio, flutter, vscode, pycharm, joplin
70 - low priority: unity, stability matrix, vlc

subcat:
10 - block rules high priority: usually empty, required for emergency "block first" rules
30 - block rules: blocked apps go here. Filter out all the unwanted traffic first
50 - high priority rules: usually empty, used for "let it through NOW" rules
70 - normal priority rules: all allowed apps go here
90 - low priority rules: apps that should be filtered last in current category

One more example:

00_00-localhost - allows dst 127.0.0.1
10_30-avahi - blocks avahi daemon
10_70-dsnmasq - allows dnsmasq on localhost
20_40-apt_http - allows apt package manager
20_70-wget
30_70-dockerd 
50_70-firefox - allows firefox
70-30-vlc - blocks vlc

This system allows to have app category and priority based filtering.
Would be really awesome if UI could have ability to assign that categories and do appropriate naming or filtering using category->subcategory order.