Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense not propagating "system aliases" (lanX net/ lanX address)

    Scheduled Pinned Locked Moved Firewalling
    41 Posts 5 Posters 5.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      Tobi @johnpoz
      last edited by Tobi

      @johnpoz - I don't think I'm ready to take that step. As long as I have to work from home, I can't sit down offline.
      Is there a place where you can see the system aliases and the IP configuration for them?

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @Tobi
        last edited by johnpoz

        @tobi said in pfSense not propagating "system aliases" (lanX net/ lanX address):

        system aliases and the IP configuration for them?

        Not that I am aware of - you can view tables that are used - but not exactly sure the address and nets are parsed or where from.. Maybe its in the xml file? And yours is corrupt, but those are not actual table values that you can view with day diag menu, tables.

        That is why I had called @stephenw10 and @Derelict into the previous thread - thought they might have some ideas on where to exactly check, and might know how that gets filled in when you use them in a rule, etc. off the top of their heads sort of thing - I would have to dig into that.

        I have never seen such an issue before. Been on the forums long long time, and I don't recall ever seeing anything like this or even close to it before.

        My thought was something with the IPv6 and IPv4 thing might be cause - but clearly that is not the case because you have the same issue with just IPv4 rule - and clearly from the actual rules looking at, for whatever reason pfsense is not parsing these values like it should.

        edit:
        I looked in the config, and really the only thing that jumps out at me at where that info is stored is in the interfaces section.. like so

        <lan>
        			<enable></enable>
        			<if>igb0</if>
        			<descr><![CDATA[LAN]]></descr>
        			<spoofmac></spoofmac>
        			<ipaddr>192.168.9.253</ipaddr>
        			<subnet>24</subnet>
        			<ipaddrv6>2001:470:snipped::253</ipaddrv6>
        			<subnetv6>64</subnetv6>
        		</lan>
        

        So there is some method that parses that info when firewall rules are created - why its failing on yours is odd for sure..

        Have to look through the code for when a firewall rule is created to how it determines the address or the net..

        While you have a working work around, with your created aliases - really should get to why/how this even happening..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        T 1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Are you able to send us diag info from that firewall to investigate further?

          T 1 Reply Last reply Reply Quote 1
          • T
            Tobi @stephenw10
            last edited by

            @stephenw10 - Sure, I can do it with pleasure. Unfortunately, I don't know exactly what you mean by that. Where/how do I find the diag info?

            1 Reply Last reply Reply Quote 0
            • T
              Tobi @johnpoz
              last edited by

              @johnpoz said in pfSense not propagating "system aliases" (lanX net/ lanX address):

              I looked in the config, a

              I wanted to post a part from the interface section but always get a message that it is detected as spam.

              T 1 Reply Last reply Reply Quote 0
              • T
                Tobi @Tobi
                last edited by Tobi

                I looked at my old box. It was last equipped with 2.5.2. There it works.
                However, the old box I can not put into operation, because it has much fewer ports and the configuration no longer fits. The configuration on the new box I had then taken over from the old.

                (at the opportunity - is there a way to reload the filters via the CLI?)

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @Tobi
                  last edited by

                  @tobi said in pfSense not propagating "system aliases" (lanX net/ lanX address):

                  The configuration on the new box I had then taken over from the old.

                  So you loaded the xml from the old into the new?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  T 1 Reply Last reply Reply Quote 0
                  • T
                    Tobi @johnpoz
                    last edited by

                    @johnpoz said in pfSense not propagating "system aliases" (lanX net/ lanX address):

                    So you loaded the xml from the old into the new?

                    In first part yes. Later I changed many things - because the new one has more interfaces.

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @Tobi
                      last edited by

                      @tobi hmmm - issue could be related to that method??

                      Would be good test to do a clean install, does it work.. Then restore you backup config.. But as you mentioned your not to that stage yet.

                      But I am not sure where to go next with this, other then clean install, and then restore of config to see if creates the problem.

                      Maybe @stephenw10 has some stuff to check? I am at a loss to what could cause this.. But I am not completely sure on all the things involved on how it parses out the variables in the rules for address and net.

                      But clearly its working as far as interfaces, or your work around of your own aliases with the cidr network in them wouldn't be working either

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      T 1 Reply Last reply Reply Quote 0
                      • T
                        Tobi @johnpoz
                        last edited by

                        @johnpoz Thank you.
                        Do you have any idea where/how I can get the diag info that @stephenw10 is asking for?

                        johnpozJ S 2 Replies Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @Tobi
                          last edited by

                          @tobi not sure what he is asking for.. Sure he will chime in on specifics soon enough.. Just give him some time - it is the weekend ;)

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 1
                          • S
                            SteveITS Galactic Empire @Tobi
                            last edited by

                            @tobi I think he means
                            https://docs.netgate.com/pfsense/en/latest/recipes/diagnostic-data.html

                            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                            Upvote 👍 helpful posts!

                            johnpozJ T 2 Replies Last reply Reply Quote 2
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @SteveITS
                              last edited by

                              @steveits yup - that would most likely be it for sure..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • T
                                Tobi @SteveITS
                                last edited by

                                @steveits said in pfSense not propagating "system aliases" (lanX net/ lanX address):

                                I think he means

                                Yes it makes sense. However, I will wait for his answer, because in the whole diag I think there is too much data that does not belong in a public forum.
                                Maybe he mean "only" the Firewall-*.txt files

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @Tobi
                                  last edited by

                                  @tobi you can for sure that file just to @stephenw10

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Yes, exactly that. If you can gather the status output file from that page you can upload it to me here: https://nc.netgate.com/nextcloud/s/bTgFR9wa8MAcGij

                                    Steve

                                    T 1 Reply Last reply Reply Quote 0
                                    • T
                                      Tobi @stephenw10
                                      last edited by Tobi

                                      @stephenw10 Thank you Steve, I have uploaded the file.
                                      I am already excited whether you can find something there.

                                      In the FW rules there is 1 with the error - search for "Windows 138". Lan0 Interface

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Hmm, did you manually edit the config before importing it at some point?

                                        The internal interface names are not the expected defaults. Just wondering if something is internally still referencing the default names since wan is the only interface that would match.

                                        Steve

                                        johnpozJ T 2 Replies Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @stephenw10
                                          last edited by johnpoz

                                          @stephenw10 said in pfSense not propagating "system aliases" (lanX net/ lanX address):

                                          did you manually edit the config before importing it at some point?

                                          I think he did, because look few posts back he imported that config from a different machine that had less interfaces.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            Tobi @stephenw10
                                            last edited by Tobi

                                            @stephenw10 said in pfSense not propagating "system aliases" (lanX net/ lanX address):

                                            Hmm, did you manually edit the config before importing it at some point?

                                            Yes. The old box had only 2 physical interfaces. The new one i mean 8. So I edited some names and changed the relation "LAN0 - igb1" or so. With the old box I had also adapted the names

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.