pfSense not propagating "system aliases" (lanX net/ lanX address)

Tobi

@johnpoz - I don't think I'm ready to take that step. As long as I have to work from home, I can't sit down offline.
Is there a place where you can see the system aliases and the IP configuration for them?

johnpoz

@tobi said in pfSense not propagating "system aliases" (lanX net/ lanX address):

system aliases and the IP configuration for them?

Not that I am aware of - you can view tables that are used - but not exactly sure the address and nets are parsed or where from.. Maybe its in the xml file? And yours is corrupt, but those are not actual table values that you can view with day diag menu, tables.

That is why I had called @stephenw10 and @Derelict into the previous thread - thought they might have some ideas on where to exactly check, and might know how that gets filled in when you use them in a rule, etc. off the top of their heads sort of thing - I would have to dig into that.

I have never seen such an issue before. Been on the forums long long time, and I don't recall ever seeing anything like this or even close to it before.

My thought was something with the IPv6 and IPv4 thing might be cause - but clearly that is not the case because you have the same issue with just IPv4 rule - and clearly from the actual rules looking at, for whatever reason pfsense is not parsing these values like it should.

edit:
I looked in the config, and really the only thing that jumps out at me at where that info is stored is in the interfaces section.. like so

<lan>
			<enable></enable>
			<if>igb0</if>
			<descr><![CDATA[LAN]]></descr>
			<spoofmac></spoofmac>
			<ipaddr>192.168.9.253</ipaddr>
			<subnet>24</subnet>
			<ipaddrv6>2001:470:snipped::253</ipaddrv6>
			<subnetv6>64</subnetv6>
		</lan>

So there is some method that parses that info when firewall rules are created - why its failing on yours is odd for sure..

Have to look through the code for when a firewall rule is created to how it determines the address or the net..

While you have a working work around, with your created aliases - really should get to why/how this even happening..

stephenw10

Are you able to send us diag info from that firewall to investigate further?

Tobi

@stephenw10 - Sure, I can do it with pleasure. Unfortunately, I don't know exactly what you mean by that. Where/how do I find the diag info?

Tobi

@johnpoz said in pfSense not propagating "system aliases" (lanX net/ lanX address):

I looked in the config, a

I wanted to post a part from the interface section but always get a message that it is detected as spam.

Tobi

I looked at my old box. It was last equipped with 2.5.2. There it works.
However, the old box I can not put into operation, because it has much fewer ports and the configuration no longer fits. The configuration on the new box I had then taken over from the old.

(at the opportunity - is there a way to reload the filters via the CLI?)

johnpoz

@tobi said in pfSense not propagating "system aliases" (lanX net/ lanX address):

The configuration on the new box I had then taken over from the old.

So you loaded the xml from the old into the new?

Tobi

@johnpoz said in pfSense not propagating "system aliases" (lanX net/ lanX address):

So you loaded the xml from the old into the new?

In first part yes. Later I changed many things - because the new one has more interfaces.

johnpoz

@tobi hmmm - issue could be related to that method??

Would be good test to do a clean install, does it work.. Then restore you backup config.. But as you mentioned your not to that stage yet.

But I am not sure where to go next with this, other then clean install, and then restore of config to see if creates the problem.

Maybe @stephenw10 has some stuff to check? I am at a loss to what could cause this.. But I am not completely sure on all the things involved on how it parses out the variables in the rules for address and net.

But clearly its working as far as interfaces, or your work around of your own aliases with the cidr network in them wouldn't be working either

Tobi

@johnpoz Thank you.
Do you have any idea where/how I can get the diag info that @stephenw10 is asking for?

johnpoz

@tobi not sure what he is asking for.. Sure he will chime in on specifics soon enough.. Just give him some time - it is the weekend ;)

SteveITS

@tobi I think he means
https://docs.netgate.com/pfsense/en/latest/recipes/diagnostic-data.html

johnpoz

@steveits yup - that would most likely be it for sure..

Tobi

@steveits said in pfSense not propagating "system aliases" (lanX net/ lanX address):

I think he means

Yes it makes sense. However, I will wait for his answer, because in the whole diag I think there is too much data that does not belong in a public forum.
Maybe he mean "only" the Firewall-*.txt files

johnpoz

@tobi you can for sure that file just to @stephenw10

stephenw10

Yes, exactly that. If you can gather the status output file from that page you can upload it to me here: https://nc.netgate.com/nextcloud/s/bTgFR9wa8MAcGij

Steve

Tobi

@stephenw10 Thank you Steve, I have uploaded the file.
I am already excited whether you can find something there.

In the FW rules there is 1 with the error - search for "Windows 138". Lan0 Interface

stephenw10

Hmm, did you manually edit the config before importing it at some point?

The internal interface names are not the expected defaults. Just wondering if something is internally still referencing the default names since wan is the only interface that would match.

Steve

johnpoz

@stephenw10 said in pfSense not propagating "system aliases" (lanX net/ lanX address):

did you manually edit the config before importing it at some point?

I think he did, because look few posts back he imported that config from a different machine that had less interfaces.

Tobi

@stephenw10 said in pfSense not propagating "system aliases" (lanX net/ lanX address):

Hmm, did you manually edit the config before importing it at some point?

Yes. The old box had only 2 physical interfaces. The new one i mean 8. So I edited some names and changed the relation "LAN0 - igb1" or so. With the old box I had also adapted the names