host in alias used by firewallrule refuses to work

a1aba

@Gblenn killed all states earlier, no solution
only 1 connection active on that host
for troubleshooting tested it on NIC and WiFi (perhaps MAC related, but the same issue)

Gblenn

@a1aba said in host in alias used by firewallrule refuses to work:

@Gblenn killed all states earlier, no solution
only 1 connection active on that host
for troubleshooting tested it on NIC and WiFi (perhaps MAC related, but the same issue)

Ok so I suppose it got a different IP on wifi right? And you changed the rule to match the new IP?
Also, when you checked the IP on the host, did you check with ipconfig /all (assuming windows)? I mean an application can generate an additional connection...

a1aba

@Gblenn yep, tried it all
strange thing is if delete the alias from the rule and change it to "any" as source it does work and the hosts gets the VPN IP (ipchicken.com to chech that)

Gblenn

@a1aba said in host in alias used by firewallrule refuses to work:

@Gblenn yep, tried it all
strange thing is if delete the alias from the rule and change it to "any" as source it does work and the hosts gets the VPN IP (ipchicken.com to chech that)

Yes that is really strange... and is the result the same if you use "LAN subnet" instead of any as the source?

Btw, do you have IPv6 enabled in pfsense?

stephenw10

@Gblenn said in host in alias used by firewallrule refuses to work:

Besides some other rule superseeding this one, could it be sticky states playing into this?

It would be unlikely for a connection to, say, ipchicken.com. A TCP/https connection like that would be new each time you opened or refreshed the page and should use the new rules to create new states.

Open a state by starting a ping. Then check the states to see what rule opened that: pfctl -vvss

Then check the ruleset to see what rule that is: pfctl -vvsr

It's either not matching your new rule or getting matched by some other rule before it reaches it.

Or it's not loading your new rule at all. Make sure Status > Filter Reload returns clean.

SteveITS

OP's screen cap above shows open states on the rule. (I assume the .43 is the desired client IP, didn't reread this thread)

The third rule should block all other traffic as long as .43 is in the VPN alias. (it also has 10kb traffic)

@a1aba Do you have "Do not create rules when gateway is down" checked?
https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#enforcing-gateway-use

a1aba

@Gblenn no IPV6 in pfsense and none configured on client

a1aba

@SteveITS said in host in alias used by firewallrule refuses to work:

OP's screen cap above shows open states on the rule. (I assume the .43 is the desired client IP, didn't reread this thread)

The third rule should block all other traffic as long as .43 is in the VPN alias. (it also has 10kb traffic)

@a1aba Do you have "Do not create rules when gateway is down" checked?
https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#enforcing-gateway-use

turned the setting on and it worked
deleted the rule for the .43 address and disabled WiFi and enabled the NIC and updated the alias with the NIC ip address and it keeps working now

turned the setting off (it was never on to begin with) again and it keeps on working now

SteveITS

@a1aba ...you're welcome...?

¯\_(ツ)_/¯

a1aba

@SteveITS said in host in alias used by firewallrule refuses to work:

@a1aba ...you're welcome...?
¯\_(ツ)_/¯

thanks for the help of course!
vereybody who helped thanks for the effort