can't use alias anymore on nat / port forward

kiokoman · Oct 20, 2020, 11:53 PM

error
A valid destination bit count must be specified.

Version	2.5.0-DEVELOPMENT (amd64)
built on Tue Oct 20 13:03:46 EDT 2020
FreeBSD 12.2-STABLE
The system is on the latest version.
Version information updated at Tue Oct 20 23:47:36 CEST 2020

if I try to edit an existing NAT rule the destination change from "single host or alias" to "Network"
if I use a single IP instead of an alias it work

viktor_g · Oct 21, 2020, 9:53 AM

Fix:
https://redmine.pfsense.org/issues/10984#note-5

kiokoman · Oct 21, 2020, 9:58 AM

thanks @viktor_g but the link to the fix i think is wrong, i can't open / see https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/23

also there is a ticket open for it
https://redmine.pfsense.org/issues/10996

rbgarga · Oct 21, 2020, 11:35 AM

Fix is now applied and will be available on next round of snapshots

kiokoman · Oct 21, 2020, 4:54 PM

ok the patch work and i can use alias again,
I tested a nat port forward for ipv6
and this is what I get

Filter Reload
There were error(s) loading the rules: /tmp/rules.debug:119: syntax error - The line in question reads [119]: rdr on vmx0 inet6 proto { tcp udp } from any to ! port 53 -&gt; 2001:470:b682:ffff:ffff:ffff:ffff:fffe
@ 2020-10-21 13:49:58

viktor_g · Oct 21, 2020, 4:54 PM

@kiokoman https://redmine.pfsense.org/issues/10984#note-7

kiokoman · Oct 21, 2020, 5:29 PM

yup it seems to be ok now

kiokoman · Oct 22, 2020, 9:44 PM

tested now for 24 hours without any problem, rules and redirect work as expected, at least for dns

; <<>> DiG 9.16.8 <<>> -6 @abcd:1234:abcd::1234 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20698
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1432
; COOKIE: b4478e1af406b0c4010000005f91fd06f6450beac9f0f72e (good)
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             264     IN      A       216.58.206.78

;; Query time: 2 msec
;; SERVER: abcd:1234:abcd::1234#53(abcd:1234:abcd::1234)
;; WHEN: Thu Oct 22 23:43:34 ora legale Europa occidentale 2020
;; MSG SIZE  rcvd: 83

[2.5.0-DEVELOPMENT][root@pfSense.kiokoman.home]/tmp: cat rules.debug | grep DNSv6
table <DNSv6> {   2001:470:b682:ffff:ffff:ffff:ffff:fffe  2001:470:26:5dc:ffff:ffff:ffff:fffd }
DNSv6 = "<DNSv6>"
rdr on vmx0 inet6 proto { tcp udp } from ! $DNSv6 to ! $DNSv6 port 53 -> 2001:470:b682:ffff:ffff:ffff:ffff:fffe
pass  in log  quick  on $LAN inet6 proto { tcp udp }  from ! $DNSv6 to 2001:470:b682:ffff:ffff:ffff:ffff:fffe port 53 tracker 1603300825 keep state  label "USER_RULE: NAT "