Rule error after OpenVPN Wizard Setup



  • pfSense 2.4.3-Release
    WAN is Static IPV4 with 4 Virtual IPs, no IPV6
    LAN is Static IPV4, No IPV6

    Main IP is xxx.xxx.xxx.18, but mail server and surveillance system use .19 and .21 respectively.

    I do have a hybrid outbound nat with a custom rule that takes any data from the IP of the mail server/32 to go out .19

    No other weird configs. Just the mailserver so the outbound goes out a different IP than the normal internet traffic.

    I also have it connected to pfMonitor, but the errors started showing before that.

    I did OpenVPN wizard and then I started getting an error:
    There were error(s) loading the rules: /tmp/rules.debug:178: unknown protocol udp4 - The line in question reads [178]: pass in quick on $WAN reply-to ( igb0 xx.xx.xx.1 ) inet proto udp4 from any to xx.xx.xx.18 tracker 1526061252 keep state label "USER_RULE: OpenVPN XXXSSLVPN1194UDP wizard"
    @ 2018-05-11 14:40:09

    It does seem to come back to a bug, but back in 2.4.2 and I thought fixed in 2.4.2-p1. Did 2.4.3 regress…

    My other 50 or so pfSense firewalls are all on 2.4.3 but had OpenVPN set up before 2.4.3. I have seen no errors on them.

    This was a re-purposed firewall that was reset to defaults and upgraded to 2.4.3 and then configured.



  • @MeeleIkon:


    I did OpenVPN wizard  ....

    Oh-ho. That trip-wired a small bug present in the OpenVPN Wizard : https://redmine.pfsense.org/issues/8391
    @MeeleIkon:

    There were error(s) loading the rules: /tmp/rules.debug:178: unknown protocol udp4 - The line in question reads [178]: pass in quick on $WAN reply-to ( igb0 xx.xx.xx.1 ) inet proto udp4 from any to xx.xx.xx.18 tracker 1526061252 keep state label "USER_RULE: OpenVPN XXXSSLVPN1194UDP wizard"
    @ 2018-05-11 14:40:09

    Yep, that's the one. The forum has it mentioned everywhere.

    No need to path or repair or wait for a new pfSense version , just re-do the WAN openvpn Wizard-generated rule and you're ok.



  • Well, that did work….

    Also curious and shame on me for not looking at the auto-generated ruled more closely, it had the port as * and not 1194 UDP....