Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Is it possible to change an alias dynamically?

    Scheduled Pinned Locked Moved Firewalling
    46 Posts 6 Posters 6.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      Tobi @SteveITS
      last edited by

      @steveits I'm not sure if I understand what do you mean with built in
      I mean this part

      19-07-_2022_19-10-04.jpg

      Do you means maybe this one?

      19-07-_2022_19-11-26.jpg

      R 1 Reply Last reply Reply Quote 0
      • R
        rcoleman-netgate Netgate @Tobi
        last edited by

        @tob that list is of known/created interfaces, not aliases.

        Ryan
        Repeat, after me: MESH IS THE DEVIL! MESH IS THE DEVIL!
        Requesting firmware for your Netgate device? https://go.netgate.com
        Switching: Mikrotik, Netgear, Extreme
        Wireless: Aruba, Ubiquiti

        T 1 Reply Last reply Reply Quote 0
        • T
          Tobi @rcoleman-netgate
          last edited by

          @rcoleman-netgate OK and where I can find build in Network aliases?

          R S 2 Replies Last reply Reply Quote 0
          • R
            rcoleman-netgate Netgate @Tobi
            last edited by

            @tobi Firewall->Aliases

            3e0b542d-8efb-4e9b-ba23-717d0ef5786b-image.png

            Then you choose "Alias" in the drop menu and enter the Alias name in the text field next to it on the form.

            Ryan
            Repeat, after me: MESH IS THE DEVIL! MESH IS THE DEVIL!
            Requesting firmware for your Netgate device? https://go.netgate.com
            Switching: Mikrotik, Netgear, Extreme
            Wireless: Aruba, Ubiquiti

            1 Reply Last reply Reply Quote 0
            • S
              SteveITS Galactic Empire @Tobi
              last edited by

              @tobi "LAN5 Net" is to what I was referring.

              Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
              When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
              Upvote 👍 helpful posts!

              1 Reply Last reply Reply Quote 1
              • Bob.DigB
                Bob.Dig LAYER 8 @Tobi
                last edited by Bob.Dig

                @tobi said in Is it possible to change an alias dynamically?:

                It would be nice if this could be done automatically.

                You can't. There is a lot to desire when it comes to dynamic IPv6 in pfSense.

                One thing you can do is create an alias from a hostname which is set in a static mapping in the DHCPv6 Server in pfSense, similar to how it works with the DHCPv4 Server. That hostname, and with that, that alias you created, will be updated automatically.

                T 1 Reply Last reply Reply Quote 0
                • T
                  Tobi @Bob.Dig
                  last edited by

                  Thanks all for the answers.
                  I will try if I can achieve everything with the proposal of @SteveITS

                  Bob.DigB 1 Reply Last reply Reply Quote 0
                  • Bob.DigB
                    Bob.Dig LAYER 8 @Tobi
                    last edited by

                    @tobi Looking at your screenshot more closely, yes, just use the build in *_net for that, no need for aliases in the first place.

                    T 1 Reply Last reply Reply Quote 0
                    • T
                      Tobi @Bob.Dig
                      last edited by

                      @bob-dig Does not work unfortunately and I have absolutely no idea why at the moment.
                      As soon as I take out the aliases in the FW rules and enter the "lanX" networks, the communication is blocked.
                      Here an example for ICMP

                      1. Works great
                        21-07-_2022_17-09-52.jpg

                      2. Alias definition
                        21-07-_2022_17-10-15.jpg

                      3. Not work anymore
                        21-07-_2022_17-12-02.jpg
                        21-07-_2022_17-13-39.jpg

                      Bob.DigB 1 Reply Last reply Reply Quote 0
                      • Bob.DigB
                        Bob.Dig LAYER 8 @Tobi
                        last edited by

                        @tobi Show us your rule and what you want to achieve.

                        S T 2 Replies Last reply Reply Quote 0
                        • S
                          SteveITS Galactic Empire @Bob.Dig
                          last edited by

                          @bob-dig As I understand it, he's trying to create firewall rules for an IPv6 subnet that changes. I was thinking the "Net" interfaces would update with the new IPv6 subnet, though (sorry) I haven't tried that.

                          Ryan @rcoleman-netgate do you know at what point the "Net" interface definition updates if the assigned IPv6 changes? Is it not instant?

                          @Tobi Do you need to know the IPv6 subnet at the point of doing the rules? I mean, can you not just allow or block IPv6 on that interface? Or are you trying to allow one subnet but block another IPv6 subnet routed through it? Also your example was IPv4, though I'd have expected that to work based on your rule. The rule did allow something because it shows 350 bytes.

                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                          Upvote 👍 helpful posts!

                          Bob.DigB T 2 Replies Last reply Reply Quote 0
                          • Bob.DigB
                            Bob.Dig LAYER 8 @SteveITS
                            last edited by

                            @steveits said in Is it possible to change an alias dynamically?:

                            I was thinking the "Net" interfaces would update with the new IPv6 subnet, though (sorry) I haven't tried that.

                            They do or there is no IPv6 connectivity at all.

                            S 1 Reply Last reply Reply Quote 0
                            • T
                              Tobi @Bob.Dig
                              last edited by Tobi

                              @bob-dig
                              21-07-_2022_17-34-44.jpg

                              @bob-dig said in Is it possible to change an alias dynamically?:

                              They do or there is no IPv6 connectivity at all.

                              Here is a ICMP response with my "Yellow_Network" Alias

                              "ping www.google.com

                              Ping wird ausgeführt für www.google.com [2a00:1450:4001:82a::2004] mit 32 Bytes Daten:
                              Antwort von 2a00:1450:4001:82a::2004: Zeit=7ms
                              Antwort von 2a00:1450:4001:82a::2004: Zeit=8ms
                              Antwort von 2a00:1450:4001:82a::2004: Zeit=7ms
                              Antwort von 2a00:1450:4001:82a::2004: Zeit=7ms"

                              Bob.DigB 1 Reply Last reply Reply Quote 0
                              • T
                                Tobi @SteveITS
                                last edited by

                                @steveits said in Is it possible to change an alias dynamically?:

                                The rule did allow something because it shows 350 bytes.

                                Yes, because with the alias (Yellow_network ) ping works, both ipv4 and ipv6

                                1 Reply Last reply Reply Quote 0
                                • Bob.DigB
                                  Bob.Dig LAYER 8 @Tobi
                                  last edited by

                                  @tobi Show us what is not working and what you are trying in great detail.

                                  T 1 Reply Last reply Reply Quote 0
                                  • T
                                    Tobi @Bob.Dig
                                    last edited by

                                    @bob-dig -
                                    I'm trying simple ping (ICMP)

                                    with "lan3 net"
                                    21-07-_2022_17-42-57.jpg

                                    it will not work. All packages are block.

                                    same rule but with my alias "Yellow_Network" all works great.

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      SteveITS Galactic Empire @Bob.Dig
                                      last edited by

                                      @bob-dig said in Is it possible to change an alias dynamically?:

                                      @steveits said in Is it possible to change an alias dynamically?:

                                      I was thinking the "Net" interfaces would update with the new IPv6 subnet, though (sorry) I haven't tried that.

                                      They do or there is no IPv6 connectivity at all.

                                      OK well when you write it out like that... :) That's why I suggested LAN3 Net but he's saying it doesn't work, which doesn't make a lot of sense to me.

                                      @Tobi are you sure it's not another rule blocking it? If you click the red X on the log line you'll get a popup like:

                                      "The rule that triggered this action is:
                                      @58(0) block drop in log quick on igb1 from bogonsv6:132925 to any label "block bogon IPv6 networks from WAN" ridentifier 11002"

                                      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                      Upvote 👍 helpful posts!

                                      T 1 Reply Last reply Reply Quote 0
                                      • T
                                        Tobi @SteveITS
                                        last edited by Tobi

                                        @steveits - This rule is not blocking the trafic. But pfSense don't see the source as part of "Lan3 net" -what is not true
                                        LAN3 192.168.4.10/24. My source is 192.168.4.15

                                        And blocking rule is at the end

                                        Red X means:

                                        "Die Regel, die diese Aktion ausgelöst hat, ist:

                                        @480(0) block drop in log quick on igb4 inet from <Yellow_Network:2> to any label "USER_RULE: Deny LAN3" ridentifier 1631830970"
                                        "

                                        S 1 Reply Last reply Reply Quote 0
                                        • S
                                          SteveITS Galactic Empire @Tobi
                                          last edited by

                                          @tobi So, it sounds like you have a separate "Deny LAN3" rule that is blocking the pings.

                                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                          Upvote 👍 helpful posts!

                                          T 1 Reply Last reply Reply Quote 0
                                          • T
                                            Tobi @SteveITS
                                            last edited by

                                            @steveits No. I have many rules they allows things and at the end on each interface I have "Deny Rule for ALL"

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.