Is it possible to change an alias dynamically?

SteveITS

@johnpoz said in Is it possible to change an alias dynamically?:

lan3 interface is 192.168.4.10/24 and your saying if you change the source to lan3 net no rules work?
That makes no sense

Yes he is and I agree it doesn't make sense. :) Also his OP asked about IPv6 but the examples are IPv4. Not that that's a problem (other than it not working) but the IPv4 subnet would not normally change over time...possibly ever.

@Tobi are you creating these rules ON the LAN3 interface? So the rule with the source of LAN3 Net is on LAN3 not another interface? Your example above was on LAN9 but that could be just what you screen captured. (a rule on LAN9 with a source of LAN3 Net isn't going to match because packets will never arrive on LAN9 from that).

Tobi

@johnpoz said in Is it possible to change an alias dynamically?:

So if you if your lan3 interface is 192.168.4.10/24 and your saying if you change the source to lan3 net no rules work?

No, no - This rule not work anymore
Or with other words - all rules if I change alias to lanX net not work anymore.

@steveits said in Is it possible to change an alias dynamically?:

are you creating these rules ON the LAN3 interface?

Yes this "ping Rule is on LAN3" - my examle was lan9, but after I changed all rules from Alias to lanX net it was not possible for me to connect to my pfSense box and I needed to reboot it with old rule set (with aliases).
After them I created this simple ping rule to see and I'm trying here to reseolve whats going wrong by my box.

johnpoz

@tobi I really want to see what the actual rules look like when you change to X net.. Are they just not populating anything, some wrong cidr?

Tobi

@johnpoz said in Is it possible to change an alias dynamically?:

So look at your rules when set as yellow_network alias with

pass  in  quick  on $LAN3 inet proto icmp  from $Yellow_Network to any ridentifier 1487960029 keep state  label "USER_RULE: Ping"
pass  in  quick  on $LAN3 inet6 proto ipv6-icmp  from $Yellow_Network to any ridentifier 1487960029 keep state  label "USER_RULE: Ping"

Oops after I changed it to lan3 net

pass  in log  quick  on $LAN3 inet6 proto tcp  from $Yellow_Network to $Green_Network port 3389 ridentifier 1631863185 flags S/SA keep state  label "USER_RULE: RDP"
**# source address is empty.  label "USER_RULE: Ping"
# source address is empty.  label "USER_RULE: Ping"**
pass  in  quick  on $LAN3 inet proto tcp  from $Yellow_Network to $AD_Controller port $AD_TCP ridentifier 1630087169 flags S/SA keep state  label "USER_RULE: Ad Kommunikation TCP"

Tobi

@johnpoz said in Is it possible to change an alias dynamically?:

are you doing anything with captive portal settings?

No newer

johnpoz

@tobi so for whatever reason lan3 net is not populated.. Hmmmm??? That would for sure explain why it doesn't work.

edit: Wonder if maybe the IPv6 isn't working and that causing a problem.. Could you try turning off the IPv6 on this interface and then looking at the rules when set to Lan3 net.

Tobi

@johnpoz said in Is it possible to change an alias dynamically?:

That would for sure explain why it doesn't work.

I think so but I have absolut no idea whats going wrong here :(

johnpoz

@tobi see my edit - maybe try it with ipv6 turned off on the interface.

Tobi

@johnpoz said in Is it possible to change an alias dynamically?:

Wonder if maybe the IPv6 isn't working and that causing a problem..

IPv6 is working very well.

I can chack what happens if I disable "track" WAN Interface for IPv6 for this interface

johnpoz

@tobi yeah just grasping at straws on why when you pick lan3 net that says no source defined.

Tobi

@johnpoz said in Is it possible to change an alias dynamically?:

maybe try it with ipv6 turned off on the interface.

This chances nothing

# source address is empty.  label "USER_RULE: Ping"
# source address is empty.  label "USER_RULE: Ping"

Tobi

@johnpoz said in Is it possible to change an alias dynamically?:

yeah just grasping at straws on why when you pick lan3 net that says no source defined.

Yes it's true but this happens with each interface/ LanX Net I'm trying. Not only lan3

And If I try to modiify the Rule

Ping from Yellow_Network to LAN4 Net then in in rules.debug I see "destination address is empty"

stephenw10

Hmm... well that's extremely odd!

This is in pfSense 2.6?

Are you using any of the System Aliases (LANx Net) in any firewall rules successfully?

Do you see the 'system aliases' section in the rules.debug file?
Is LAN3 referencing the correct interface?
I expect both those to be true because the traffic is being blocked correctly still.

Try adding the v4 and v6 rules as separate lines in the config.
The scripts create then as separate rules line anyway but it could be trying to validate the LANx net alias as both v4 and v6 at the same time and failing both somehow.

Steve

Tobi

@stephenw10 said in Is it possible to change an alias dynamically?:

This is in pfSense 2.6?

Yes

@stephenw10 said in Is it possible to change an alias dynamically?:

Are you using any of the System Aliases (LANx Net) in any firewall rules successfully?

No.

@stephenw10 said in Is it possible to change an alias dynamically?:

Do you see the 'system aliases' section in the rules.debug file?

#System aliases

loopback = "{ lo0 }"
WAN = "{ pppoe0 }"
LAN0 = "{ igb1 }"
LAN1 = "{ igb2 }"
LAN2 = "{ igb3 }"
LAN3 = "{ igb4 }"
LAN4 = "{ igb3.150 }"
LAN5 = "{ igb3.250 }"
LAN6 = "{ igb3.20 }"
LAN7 = "{ igb2.30 }"
LAN8 = "{ igb2.40 }"
LAN9 = "{ igb2.50 }"
OpenVPN = "{ openvpn }"

@stephenw10 said in Is it possible to change an alias dynamically?:

Try adding the v4 and v6 rules as separate lines in the config.

Yesterday I tryed to disable ipv6 from this interface and create also a new rule only for IPv4 - nothing changes

Tobi

The only thing with system alias works here is my WAN Interface. I can create rule with "WAN Net" oder "WAN Address" and this works, but no other interfaces.