Can't delete an alias

BBcan177

Looks like its in the OPT1 Firewall Interface TAB…

Mr. Jingles

Mr Jingles… Didn't we do a little crash course in the "grep" command? ;D

grep -A10 -B10 "EasyRule" /conf/config.xml

Did you check all of the Firewall Interface Tabs.. One of them should have it referenced?

You know that I respect - and - like you dearly, Mr. BB, for all your great help and friendship :-*

The -A10 - B10 I must have lost :-[

[quote]
Looks like its in the OPT1 Firewall Interface TAB…

:o

But there is nothing there in the GUI(?)

('m still struggling to find out which interface is OPT1, my interfaces are named LAN, VLAN, WAN, WAN2, Ifconfig doesn't seem to want to tell me, pfctl neither :-[ ).

BBcan177

@Mr.:

I'm still struggling to find out which interface is OPT1

Goto Interfaces:Assign

You can manually delete it from the config… But you have to be careful with that or it could corrupt the file.

bennyc

Hmm, seems you have a leftover from older configuration?
If you have another spare nic in your system, you could try to assing another interface and name it OPT1.
After saving, there should be a new tab in the rules, named OPT1.
With some luck, this ghost rule should be present, using the alias you can't delete…

Sounds like an intersting experiment :D

Mr. Jingles

@BBcan177:

@Mr.:

I'm still struggling to find out which interface is OPT1

Goto Interfaces:Assign

I think you think I am retarded ;D

(you are mostly right :P ).

Of course I was there already, BB; it doesn't show there screenshot :-*

But (there's always a but): I've shocked myself thinking of a bright thing: mailreport. In there it does show which one is OPT1; it's WAN2. Which does not have that alias; only the attached screenshot (these are non-nested aliases, containing only a couple of LAN-IP's.

interfaces_assign_BB.jpg_thumb

OPT1-WAN2.jpg_thumb

Mr. Jingles

So your grep gave this, BB (edited out the other nonsense in there to keep it readable):

[2.1.5-RELEASE][root@pfsense.workgroup]/root(1): grep -A10 -B10 "EasyRule" /conf/config.xml

<destination><address>EasyRuleBlockHostsWAN</address></destination>
<log><source>

<address>EasyRuleBlockHostsWAN</address>

<address>EasyRuleBlockHostsLAN</address>

<address>zEasyRuleBlockHostsOPT1</address>
<source>

<address>EasyRuleBlockHostsOPT3</address>

<source>

<address>EasyRuleBlockHostsWAN</address>

<rule>– <detail></detail>
<alias><name>EasyRuleBlockHostsLAN</name>
<alias><name>EasyRuleBlockHostsOPT3</name>
<type>network</type>
<alias><name>EasyRuleBlockHostsWAN</name>
<alias>** <name>zEasyRuleBlockHostsOPT1</name>**

<address>

<type>network</type>
<detail><alias><type>host</type>
[2.1.5-RELEASE][root@pfsense.workgroup]/root(2):</alias></detail></address></alias></alias></alias></alias></rule></log>

So there is something in here, but not in the GUI.

Let me guess: if I edit the XML, being the me that I am, the box will be ruined :P ;D

Mr. Jingles

@bennyc:

Hmm, seems you have a leftover from older configuration?

I just set up this box completely fresh next week :-[

[quote]
If you have another spare nic in your system, you could try to assing another interface and name it OPT1.
After saving, there should be a new tab in the rules, named OPT1.
With some luck, this ghost rule should be present, using the alias you can't delete…

Sounds like an intersting experiment :D

Yes, interesting experiment indeed ;D

I don't have a VM to try that first, and OPT1 exists, and is WAN2. So I think I will blow up the box if I name another interface WAN2 too ( :-X ).

BBcan177

Its strange that it has a "z" in the alias name?

<name>zEasyRuleBlockHostsOPT1</name>

BTW… with the grep command...
-A10 means when it finds a match, show the next 10 lines.
-B10 means when it finds a match, show the previous 10 lines.

so you can remove those or change the numbers to what ever you wish...

You can try the following (This is a minimalistic approach... A better approach is to delete the complete <alias></alias>for this particular zEasyRuleBlockHostsOPT1 but there is a little more editing... And it depends how comfortable you are in editing this IMPORTANT file! So please be careful with it...

Backup pfSense Box config
From the Shell -

cp /conf/config.xml /conf/config.xml.bk

edit the /conf/config.xml in your favorite editor
remove the "z" in the name
Change OPT1 to WAN

FROM :

<address>zEasyRuleBlockHostsOPT1</address>

TO :

<address>EasyRuleBlockHostsWAN</address>

Maybe it will show up in the WAN Tab? Its hard to tell without seeing the complete snipet of the

**<alias></alias>**for this Easyrule…

save the file
rm /tmp/config.cache
8 ) Leave the SSH Window still open.. and from your browser reload the pfSense GUI.
This will reload the config.xml file without needing to reboot.
check to see if the alias shows up?
if it Fails… or god forbid crashes.....

(Only run the following two commands if you want to revert Back to the previous config)

cp /conf/config.xml.bk /conf/config.xml
rm /tmp/config.cache

This will revert back to the previous config.xml file.

But as always ;D ;D ;D –>

BBcan177

And after a few minutes of sleep, I wake with what the hell was I thinking!! LOL. Unfortunately the whole Alias needs to be manually removed from the config file.

I think the "z" in the name had something to do with it not being removed properly in the first place.

If you wish, I could Teamviewer in and help you clean it.

Mr. Jingles

@BBcan177:

I think the "z" in the name had something to do with it not being removed properly in the first place.

I doubt it; originally it didn't have a 'Z' in it. I changed the alias name to that per a thread by another member here who managed to get it away by doing that. 'tWorked for him, it didn't work for me.
_(If you want to know why the 'z' btw, I do that with most of my names in pfSense (and other systems). It's an old habit from my SAP time, where this was mandatory. The 'Y' and 'Z' were so called 'custom name spaces', only (ABAP) programs starting with that letter were allowed to be created by customers in the (huge) SAP system (and hence, these YZ-programs where only allowed certain types of access to the databases, to API's, etc. Smart engineers, over at SAP. You have to, if you want to give the management tools to the IT-departments that need to run these systems that all of the Fortune500 run).

So, the Y and Z, that way:_

It is easy to distinguish standard SAP programs from custom built modifications;
Which helps tremendously when you have to do upgrades and fixes, as the SAP upgrade will not touch these programs, but has all kinds of built in pre-upgrade analysis tools to see what custom development will be touched by what upgrade process.

(Yes, I'm the eternal noob on pfSense, but it seems I'm long past the noob-status in SAP-land ;D )).

If you wish, I could Teamviewer in and help you clean it.

You are too kind, BB :-*

Thank you ;D

I wouldn't want to take this precious time for you, especially since it's a different time zone thing. But mostly, because I do not want to take any time away from the development of pfBlockerNG :P

I think, in the end, when 2.2. is out, I will do again a completely fresh install, with your pfBlockerNG. As the old saying goes: 'it isn't eating bread' (the alias), 'so lets leave it there than.

Thanks again BB :-*