Link Alias to existing table



  • Hi,

    Is it possible to create/link an alias to an existing pf table so I can use this table in my firewall rules?

    If I create an alias and update the contents of the corresponding pf table in the background, the table is cleared when the pfsense rules are refreshed with /etc/rc.filter_configure_sync. So I'm looking for a way to prevent this table clean up.

    I think this needs a modification in /etc/inc/filter.inc but I'm not sure how.

    (I know the url alias function, but that does not really permit fast updates.)

    Thanks.

    Maarten


  • Netgate Administrator

    What table are you wanting to use in a rule that doesn't exist as a an alias out of interest?

    Steve



  • In the background I create a table like this: pfctl -t DynTestHosts -T add 1.1.1.1/32

    I add hosts to this table with the same command, and let entries expire after 48 hours.

    The problem I have to work around is the following:

    I have a few dns names that resolves in a list of ip addresess, but these addresses change constantly.

    When I add these dns names to a pfsense alias table, pfsense resolves the dns names and replaces all IP's in this list. So every ip that is not resolved that time is being removed.


  • Netgate Administrator

    So the issue is previously resolved IPs are removed everytime filterdns is run and creates a new list?

    Pulling the IPs from an external list seems like the way to go here, just how fast do you need them to update?

    Steve


  • Rebel Alliance Developer Netgate

    Make an alias in the GUI with a dummy address inside, then use it in rules, etc. You can still edit its contents with pfctl.

    If you make it a persist table (e.g. URL table alias) then it should keep your custom values across filter reloads.



  • Thanks, I'm using the URL table alias right now.


  • Netgate Administrator

    But I assume you want new resolved IPs to be added to the list as they are seen right?

    Or are you OK adding the IPs manually via pfctl?

    Steve


Log in to reply