Is it possible to change an alias dynamically?

Tobi · Jul 21, 2022, 3:38 PM

@steveits said in Is it possible to change an alias dynamically?:

The rule did allow something because it shows 350 bytes.

Yes, because with the alias (Yellow_network ) ping works, both ipv4 and ipv6

Bob.Dig · Jul 21, 2022, 3:40 PM

@tobi Show us what is not working and what you are trying in great detail.

Tobi · Jul 21, 2022, 3:45 PM

@bob-dig -
I'm trying simple ping (ICMP)

with "lan3 net"

it will not work. All packages are block.

same rule but with my alias "Yellow_Network" all works great.

SteveITS · Jul 21, 2022, 4:02 PM

@bob-dig said in Is it possible to change an alias dynamically?:

@steveits said in Is it possible to change an alias dynamically?:

I was thinking the "Net" interfaces would update with the new IPv6 subnet, though (sorry) I haven't tried that.

They do or there is no IPv6 connectivity at all.

OK well when you write it out like that... :) That's why I suggested LAN3 Net but he's saying it doesn't work, which doesn't make a lot of sense to me.

@Tobi are you sure it's not another rule blocking it? If you click the red X on the log line you'll get a popup like:

"The rule that triggered this action is:
@58(0) block drop in log quick on igb1 from bogonsv6:132925 to any label "block bogon IPv6 networks from WAN" ridentifier 11002"

Tobi · Jul 21, 2022, 4:14 PM

@steveits - This rule is not blocking the trafic. But pfSense don't see the source as part of "Lan3 net" -what is not true
LAN3 192.168.4.10/24. My source is 192.168.4.15

And blocking rule is at the end

Red X means:

"Die Regel, die diese Aktion ausgelöst hat, ist:

@480(0) block drop in log quick on igb4 inet from <Yellow_Network:2> to any label "USER_RULE: Deny LAN3" ridentifier 1631830970"
"

SteveITS · Jul 21, 2022, 4:25 PM

@tobi So, it sounds like you have a separate "Deny LAN3" rule that is blocking the pings.

Tobi · Jul 21, 2022, 4:28 PM

@steveits No. I have many rules they allows things and at the end on each interface I have "Deny Rule for ALL"

johnpoz · Jul 21, 2022, 4:42 PM

@tobi said in Is it possible to change an alias dynamically?:

I have "Deny Rule for ALL"

There really is no reason for a deny rule at the end - default is deny. So unless you want to say not log anything you don't allow (default is to log).. There isn't really a reason to add specific block at the end.. Unless you wanted to make it a reject maybe for your local devices so they get a icmp notice that rejected and can save your clients some time doing retrans, etc.

Tobi · Jul 21, 2022, 4:49 PM

@johnpoz said in Is it possible to change an alias dynamically?:

There really is no reason for a deny rule at the end

Maybe you are right. But the point is :

with Yellow_Network Alias is my Pinng "going" through this rule:

And if I change "Yellow_Network" to lan3 then my ping is not goint through this rule and is blocked at the end. And this is my problem not my rule at end.
And this because pfSense don't see that my source ip 192.168.4.15 is part of LAN3 network

johnpoz · Jul 21, 2022, 4:55 PM

@tobi said in Is it possible to change an alias dynamically?:

that my source ip 192.168.4.15 is part of LAN3 network

Well is it, what is listed on your Lan3 interface? You sure you didn't maybe make it a /32 - I believe it can default to /32 when you set the IP.

Tobi · Jul 21, 2022, 5:19 PM

@johnpoz - thank you very much for your time!

my definition is correct

But from Docs I'm not sure if this can work because:

"Interface Net

An entry in this list is present for each interface on the firewall. These macros specify the subnet for that interface exactly, including any IP alias VIP subnets that differ from the defined interface subnet.

"
So this don't mean each IP address from this Network

johnpoz · Jul 21, 2022, 5:25 PM

@tobi said in Is it possible to change an alias dynamically?:

So this don't mean each IP address from this Network

huh? Sure it does, along with any vip networks you might have setup on it.

The lan 3 net on that interface should be 192.168.4.0/24 so yeah your 192.168.4.15 - you sure you didn't use lan3 address vs net?

For your source?

You have that rule going to some queue? Maybe that is being problematic?

Tobi · Jul 21, 2022, 5:39 PM

@johnpoz said in Is it possible to change an alias dynamically?:

you sure you didn't use lan3 address vs net?

Yes I am sure. See my screenshots above

@johnpoz said in Is it possible to change an alias dynamically?:

You have that rule going to some queue?

I have no queues for any rules

johnpoz · Jul 21, 2022, 5:44 PM

@tobi said in Is it possible to change an alias dynamically?:

I have no queues for any rules

My bad "nicht gesetzt" hehehe = none or not set, etc. Doh!

BTW always better to show the full rules list vs 1 rule, since depending you could have some odd rules that trigger before rule that allows, etc.

And your floating is empty?

Tobi · Jul 21, 2022, 6:04 PM

@johnpoz said in Is it possible to change an alias dynamically?:

And your floating is empty?

Yes

@johnpoz said in Is it possible to change an alias dynamically?:

always better to show the full rules list

The only thing I change in the last rule you see here is from Yellow_Network to lan3 network

The same thing I have with all interfaces and all rules if I change from Alias to laX Network :(

johnpoz · Jul 21, 2022, 7:03 PM

@tobi well that first rule is pointless - when you enable dhcp on an interface, hidden rules are created that allow dhcp to work.

So if you if your lan3 interface is 192.168.4.10/24 and your saying if you change the source to lan3 net no rules work?

That makes no sense - all of my interfaces use X net as the source.. The only way for that to be a problem is if the X network built in aliases are not populating.

Off the top I am not sure how to actually look at that table - let me look into that.. @stephenw10 or @Derelict might be able to help us validate if X networks are actually populated or what might be not working so they are not populated.

So floating rules are empty - are you doing anything with captive portal settings?

So look at your rules when set as yellow_network alias with

cat /tmp/rules.debug

And then look at rules after you change to X network, does it not list the cidr range?

example here is my lan rule

pass  in  quick  on $LAN inet from 192.168.9.0/24 to any ridentifier 0100000101 keep state label "USER_RULE: Default allow LAN to any rule" label "id:0100000101"

Here are rules on a different interface

If I look in rules I see specific with the cidr range from dmz network as source.

pass  in  quick  on $DMZ inet from 192.168.3.0/24 to any ridentifier 1512830140 keep state label "USER_RULE" label "id:1512830140"

Here is the specific rule that allows icmp echoreq from my dmz net to dmz address

pass  in  quick  on $DMZ inet proto icmp  from 192.168.3.0/24 to 192.168.3.253 icmp-type echoreq ridentifier 1513193472 keep state label "USER_RULE" label "id:1513193472"

SteveITS · Jul 21, 2022, 7:08 PM

@johnpoz said in Is it possible to change an alias dynamically?:

lan3 interface is 192.168.4.10/24 and your saying if you change the source to lan3 net no rules work?
That makes no sense

Yes he is and I agree it doesn't make sense. :) Also his OP asked about IPv6 but the examples are IPv4. Not that that's a problem (other than it not working) but the IPv4 subnet would not normally change over time...possibly ever.

@Tobi are you creating these rules ON the LAN3 interface? So the rule with the source of LAN3 Net is on LAN3 not another interface? Your example above was on LAN9 but that could be just what you screen captured. (a rule on LAN9 with a source of LAN3 Net isn't going to match because packets will never arrive on LAN9 from that).

Tobi · Jul 21, 2022, 7:24 PM

@johnpoz said in Is it possible to change an alias dynamically?:

So if you if your lan3 interface is 192.168.4.10/24 and your saying if you change the source to lan3 net no rules work?

No, no - This rule not work anymore
Or with other words - all rules if I change alias to lanX net not work anymore.

@steveits said in Is it possible to change an alias dynamically?:

are you creating these rules ON the LAN3 interface?

Yes this "ping Rule is on LAN3" - my examle was lan9, but after I changed all rules from Alias to lanX net it was not possible for me to connect to my pfSense box and I needed to reboot it with old rule set (with aliases).
After them I created this simple ping rule to see and I'm trying here to reseolve whats going wrong by my box.

johnpoz · Jul 21, 2022, 7:28 PM

@tobi I really want to see what the actual rules look like when you change to X net.. Are they just not populating anything, some wrong cidr?

Tobi · Jul 21, 2022, 7:42 PM

@johnpoz said in Is it possible to change an alias dynamically?:

So look at your rules when set as yellow_network alias with

pass  in  quick  on $LAN3 inet proto icmp  from $Yellow_Network to any ridentifier 1487960029 keep state  label "USER_RULE: Ping"
pass  in  quick  on $LAN3 inet6 proto ipv6-icmp  from $Yellow_Network to any ridentifier 1487960029 keep state  label "USER_RULE: Ping"

Oops after I changed it to lan3 net

pass  in log  quick  on $LAN3 inet6 proto tcp  from $Yellow_Network to $Green_Network port 3389 ridentifier 1631863185 flags S/SA keep state  label "USER_RULE: RDP"
**# source address is empty.  label "USER_RULE: Ping"
# source address is empty.  label "USER_RULE: Ping"**
pass  in  quick  on $LAN3 inet proto tcp  from $Yellow_Network to $AD_Controller port $AD_TCP ridentifier 1630087169 flags S/SA keep state  label "USER_RULE: Ad Kommunikation TCP"