Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Is it possible to change an alias dynamically?

    Scheduled Pinned Locked Moved Firewalling
    46 Posts 6 Posters 6.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      Tobi @Bob.Dig
      last edited by

      @bob-dig Does not work unfortunately and I have absolutely no idea why at the moment.
      As soon as I take out the aliases in the FW rules and enter the "lanX" networks, the communication is blocked.
      Here an example for ICMP

      1. Works great
        21-07-_2022_17-09-52.jpg

      2. Alias definition
        21-07-_2022_17-10-15.jpg

      3. Not work anymore
        21-07-_2022_17-12-02.jpg
        21-07-_2022_17-13-39.jpg

      Bob.DigB 1 Reply Last reply Reply Quote 0
      • Bob.DigB
        Bob.Dig LAYER 8 @Tobi
        last edited by

        @tobi Show us your rule and what you want to achieve.

        S T 2 Replies Last reply Reply Quote 0
        • S
          SteveITS Galactic Empire @Bob.Dig
          last edited by

          @bob-dig As I understand it, he's trying to create firewall rules for an IPv6 subnet that changes. I was thinking the "Net" interfaces would update with the new IPv6 subnet, though (sorry) I haven't tried that.

          Ryan @rcoleman-netgate do you know at what point the "Net" interface definition updates if the assigned IPv6 changes? Is it not instant?

          @Tobi Do you need to know the IPv6 subnet at the point of doing the rules? I mean, can you not just allow or block IPv6 on that interface? Or are you trying to allow one subnet but block another IPv6 subnet routed through it? Also your example was IPv4, though I'd have expected that to work based on your rule. The rule did allow something because it shows 350 bytes.

          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
          Upvote 👍 helpful posts!

          Bob.DigB T 2 Replies Last reply Reply Quote 0
          • Bob.DigB
            Bob.Dig LAYER 8 @SteveITS
            last edited by

            @steveits said in Is it possible to change an alias dynamically?:

            I was thinking the "Net" interfaces would update with the new IPv6 subnet, though (sorry) I haven't tried that.

            They do or there is no IPv6 connectivity at all.

            S 1 Reply Last reply Reply Quote 0
            • T
              Tobi @Bob.Dig
              last edited by Tobi

              @bob-dig
              21-07-_2022_17-34-44.jpg

              @bob-dig said in Is it possible to change an alias dynamically?:

              They do or there is no IPv6 connectivity at all.

              Here is a ICMP response with my "Yellow_Network" Alias

              "ping www.google.com

              Ping wird ausgeführt für www.google.com [2a00:1450:4001:82a::2004] mit 32 Bytes Daten:
              Antwort von 2a00:1450:4001:82a::2004: Zeit=7ms
              Antwort von 2a00:1450:4001:82a::2004: Zeit=8ms
              Antwort von 2a00:1450:4001:82a::2004: Zeit=7ms
              Antwort von 2a00:1450:4001:82a::2004: Zeit=7ms"

              Bob.DigB 1 Reply Last reply Reply Quote 0
              • T
                Tobi @SteveITS
                last edited by

                @steveits said in Is it possible to change an alias dynamically?:

                The rule did allow something because it shows 350 bytes.

                Yes, because with the alias (Yellow_network ) ping works, both ipv4 and ipv6

                1 Reply Last reply Reply Quote 0
                • Bob.DigB
                  Bob.Dig LAYER 8 @Tobi
                  last edited by

                  @tobi Show us what is not working and what you are trying in great detail.

                  T 1 Reply Last reply Reply Quote 0
                  • T
                    Tobi @Bob.Dig
                    last edited by

                    @bob-dig -
                    I'm trying simple ping (ICMP)

                    with "lan3 net"
                    21-07-_2022_17-42-57.jpg

                    it will not work. All packages are block.

                    same rule but with my alias "Yellow_Network" all works great.

                    1 Reply Last reply Reply Quote 0
                    • S
                      SteveITS Galactic Empire @Bob.Dig
                      last edited by

                      @bob-dig said in Is it possible to change an alias dynamically?:

                      @steveits said in Is it possible to change an alias dynamically?:

                      I was thinking the "Net" interfaces would update with the new IPv6 subnet, though (sorry) I haven't tried that.

                      They do or there is no IPv6 connectivity at all.

                      OK well when you write it out like that... :) That's why I suggested LAN3 Net but he's saying it doesn't work, which doesn't make a lot of sense to me.

                      @Tobi are you sure it's not another rule blocking it? If you click the red X on the log line you'll get a popup like:

                      "The rule that triggered this action is:
                      @58(0) block drop in log quick on igb1 from bogonsv6:132925 to any label "block bogon IPv6 networks from WAN" ridentifier 11002"

                      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                      Upvote 👍 helpful posts!

                      T 1 Reply Last reply Reply Quote 0
                      • T
                        Tobi @SteveITS
                        last edited by Tobi

                        @steveits - This rule is not blocking the trafic. But pfSense don't see the source as part of "Lan3 net" -what is not true
                        LAN3 192.168.4.10/24. My source is 192.168.4.15

                        And blocking rule is at the end

                        Red X means:

                        "Die Regel, die diese Aktion ausgelöst hat, ist:

                        @480(0) block drop in log quick on igb4 inet from <Yellow_Network:2> to any label "USER_RULE: Deny LAN3" ridentifier 1631830970"
                        "

                        S 1 Reply Last reply Reply Quote 0
                        • S
                          SteveITS Galactic Empire @Tobi
                          last edited by

                          @tobi So, it sounds like you have a separate "Deny LAN3" rule that is blocking the pings.

                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                          Upvote 👍 helpful posts!

                          T 1 Reply Last reply Reply Quote 0
                          • T
                            Tobi @SteveITS
                            last edited by

                            @steveits No. I have many rules they allows things and at the end on each interface I have "Deny Rule for ALL"

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @Tobi
                              last edited by

                              @tobi said in Is it possible to change an alias dynamically?:

                              I have "Deny Rule for ALL"

                              There really is no reason for a deny rule at the end - default is deny. So unless you want to say not log anything you don't allow (default is to log).. There isn't really a reason to add specific block at the end.. Unless you wanted to make it a reject maybe for your local devices so they get a icmp notice that rejected and can save your clients some time doing retrans, etc.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              T 1 Reply Last reply Reply Quote 0
                              • T
                                Tobi @johnpoz
                                last edited by

                                @johnpoz said in Is it possible to change an alias dynamically?:

                                There really is no reason for a deny rule at the end

                                Maybe you are right. But the point is :

                                with Yellow_Network Alias is my Pinng "going" through this rule:
                                21-07-_2022_17-09-52.jpg

                                And if I change "Yellow_Network" to lan3 then my ping is not goint through this rule and is blocked at the end. And this is my problem not my rule at end.
                                And this because pfSense don't see that my source ip 192.168.4.15 is part of LAN3 network

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @Tobi
                                  last edited by johnpoz

                                  @tobi said in Is it possible to change an alias dynamically?:

                                  that my source ip 192.168.4.15 is part of LAN3 network

                                  Well is it, what is listed on your Lan3 interface? You sure you didn't maybe make it a /32 - I believe it can default to /32 when you set the IP.

                                  32.jpg

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                  T 1 Reply Last reply Reply Quote 0
                                  • T
                                    Tobi @johnpoz
                                    last edited by

                                    @johnpoz - thank you very much for your time!

                                    my definition is correct

                                    21-07-_2022_19-15-06.jpg

                                    But from Docs I'm not sure if this can work because:

                                    "Interface Net

                                    An entry in this list is present for each interface on the firewall. These macros specify the subnet for that interface exactly, including any IP alias VIP subnets that differ from the defined interface subnet.
                                    

                                    "
                                    So this don't mean each IP address from this Network

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @Tobi
                                      last edited by johnpoz

                                      @tobi said in Is it possible to change an alias dynamically?:

                                      So this don't mean each IP address from this Network

                                      huh? Sure it does, along with any vip networks you might have setup on it.

                                      The lan 3 net on that interface should be 192.168.4.0/24 so yeah your 192.168.4.15 - you sure you didn't use lan3 address vs net?

                                      For your source?

                                      You have that rule going to some queue? Maybe that is being problematic?

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                      T 1 Reply Last reply Reply Quote 0
                                      • T
                                        Tobi @johnpoz
                                        last edited by

                                        @johnpoz said in Is it possible to change an alias dynamically?:

                                        you sure you didn't use lan3 address vs net?

                                        Yes I am sure. See my screenshots above

                                        @johnpoz said in Is it possible to change an alias dynamically?:

                                        You have that rule going to some queue?

                                        I have no queues for any rules

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @Tobi
                                          last edited by johnpoz

                                          @tobi said in Is it possible to change an alias dynamically?:

                                          I have no queues for any rules

                                          My bad "nicht gesetzt" hehehe = none or not set, etc. Doh!

                                          BTW always better to show the full rules list vs 1 rule, since depending you could have some odd rules that trigger before rule that allows, etc.

                                          And your floating is empty?

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          T 1 Reply Last reply Reply Quote 0
                                          • T
                                            Tobi @johnpoz
                                            last edited by

                                            @johnpoz said in Is it possible to change an alias dynamically?:

                                            And your floating is empty?

                                            Yes

                                            @johnpoz said in Is it possible to change an alias dynamically?:

                                            always better to show the full rules list

                                            21-07-_2022_20-01-32.jpg

                                            The only thing I change in the last rule you see here is from Yellow_Network to lan3 network

                                            The same thing I have with all interfaces and all rules if I change from Alias to laX Network :(

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.