• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Is it possible to change an alias dynamically?

Scheduled Pinned Locked Moved Firewalling
46 Posts 6 Posters 6.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    johnpoz LAYER 8 Global Moderator @Tobi
    last edited by johnpoz Jul 21, 2022, 5:25 PM Jul 21, 2022, 5:23 PM

    @tobi said in Is it possible to change an alias dynamically?:

    So this don't mean each IP address from this Network

    huh? Sure it does, along with any vip networks you might have setup on it.

    The lan 3 net on that interface should be 192.168.4.0/24 so yeah your 192.168.4.15 - you sure you didn't use lan3 address vs net?

    For your source?

    You have that rule going to some queue? Maybe that is being problematic?

    An intelligent man is sometimes forced to be drunk to spend time with his fools
    If you get confused: Listen to the Music Play
    Please don't Chat/PM me for help, unless mod related
    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

    T 1 Reply Last reply Jul 21, 2022, 5:39 PM Reply Quote 0
    • T
      Tobi @johnpoz
      last edited by Jul 21, 2022, 5:39 PM

      @johnpoz said in Is it possible to change an alias dynamically?:

      you sure you didn't use lan3 address vs net?

      Yes I am sure. See my screenshots above

      @johnpoz said in Is it possible to change an alias dynamically?:

      You have that rule going to some queue?

      I have no queues for any rules

      J 1 Reply Last reply Jul 21, 2022, 5:42 PM Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator @Tobi
        last edited by johnpoz Jul 21, 2022, 5:44 PM Jul 21, 2022, 5:42 PM

        @tobi said in Is it possible to change an alias dynamically?:

        I have no queues for any rules

        My bad "nicht gesetzt" hehehe = none or not set, etc. Doh!

        BTW always better to show the full rules list vs 1 rule, since depending you could have some odd rules that trigger before rule that allows, etc.

        And your floating is empty?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        T 1 Reply Last reply Jul 21, 2022, 6:04 PM Reply Quote 0
        • T
          Tobi @johnpoz
          last edited by Jul 21, 2022, 6:04 PM

          @johnpoz said in Is it possible to change an alias dynamically?:

          And your floating is empty?

          Yes

          @johnpoz said in Is it possible to change an alias dynamically?:

          always better to show the full rules list

          21-07-_2022_20-01-32.jpg

          The only thing I change in the last rule you see here is from Yellow_Network to lan3 network

          The same thing I have with all interfaces and all rules if I change from Alias to laX Network :(

          J 1 Reply Last reply Jul 21, 2022, 6:49 PM Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator @Tobi
            last edited by johnpoz Jul 21, 2022, 7:03 PM Jul 21, 2022, 6:49 PM

            @tobi well that first rule is pointless - when you enable dhcp on an interface, hidden rules are created that allow dhcp to work.

            So if you if your lan3 interface is 192.168.4.10/24 and your saying if you change the source to lan3 net no rules work?

            That makes no sense - all of my interfaces use X net as the source.. The only way for that to be a problem is if the X network built in aliases are not populating.

            Off the top I am not sure how to actually look at that table - let me look into that.. @stephenw10 or @Derelict might be able to help us validate if X networks are actually populated or what might be not working so they are not populated.

            So floating rules are empty - are you doing anything with captive portal settings?

            So look at your rules when set as yellow_network alias with

            cat /tmp/rules.debug

            And then look at rules after you change to X network, does it not list the cidr range?

            example here is my lan rule

            rules.jpg

            pass  in  quick  on $LAN inet from 192.168.9.0/24 to any ridentifier 0100000101 keep state label "USER_RULE: Default allow LAN to any rule" label "id:0100000101"
            

            Here are rules on a different interface
            dmz.jpg

            If I look in rules I see specific with the cidr range from dmz network as source.

            pass  in  quick  on $DMZ inet from 192.168.3.0/24 to any ridentifier 1512830140 keep state label "USER_RULE" label "id:1512830140"
            

            Here is the specific rule that allows icmp echoreq from my dmz net to dmz address

            pass  in  quick  on $DMZ inet proto icmp  from 192.168.3.0/24 to 192.168.3.253 icmp-type echoreq ridentifier 1513193472 keep state label "USER_RULE" label "id:1513193472"
            

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            S T 4 Replies Last reply Jul 21, 2022, 7:08 PM Reply Quote 0
            • S
              SteveITS Galactic Empire @johnpoz
              last edited by Jul 21, 2022, 7:08 PM

              @johnpoz said in Is it possible to change an alias dynamically?:

              lan3 interface is 192.168.4.10/24 and your saying if you change the source to lan3 net no rules work?
              That makes no sense

              Yes he is and I agree it doesn't make sense. :) Also his OP asked about IPv6 but the examples are IPv4. Not that that's a problem (other than it not working) but the IPv4 subnet would not normally change over time...possibly ever.

              @Tobi are you creating these rules ON the LAN3 interface? So the rule with the source of LAN3 Net is on LAN3 not another interface? Your example above was on LAN9 but that could be just what you screen captured. (a rule on LAN9 with a source of LAN3 Net isn't going to match because packets will never arrive on LAN9 from that).

              Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
              When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
              Upvote 👍 helpful posts!

              1 Reply Last reply Reply Quote 0
              • T
                Tobi @johnpoz
                last edited by Jul 21, 2022, 7:24 PM

                @johnpoz said in Is it possible to change an alias dynamically?:

                So if you if your lan3 interface is 192.168.4.10/24 and your saying if you change the source to lan3 net no rules work?

                No, no - This rule not work anymore
                Or with other words - all rules if I change alias to lanX net not work anymore.

                @steveits said in Is it possible to change an alias dynamically?:

                are you creating these rules ON the LAN3 interface?

                Yes this "ping Rule is on LAN3" - my examle was lan9, but after I changed all rules from Alias to lanX net it was not possible for me to connect to my pfSense box and I needed to reboot it with old rule set (with aliases).
                After them I created this simple ping rule to see and I'm trying here to reseolve whats going wrong by my box.

                J 1 Reply Last reply Jul 21, 2022, 7:28 PM Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator @Tobi
                  last edited by Jul 21, 2022, 7:28 PM

                  @tobi I really want to see what the actual rules look like when you change to X net.. Are they just not populating anything, some wrong cidr?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 0
                  • T
                    Tobi @johnpoz
                    last edited by Tobi Jul 21, 2022, 7:42 PM Jul 21, 2022, 7:32 PM

                    @johnpoz said in Is it possible to change an alias dynamically?:

                    So look at your rules when set as yellow_network alias with

                    pass  in  quick  on $LAN3 inet proto icmp  from $Yellow_Network to any ridentifier 1487960029 keep state  label "USER_RULE: Ping"
                    pass  in  quick  on $LAN3 inet6 proto ipv6-icmp  from $Yellow_Network to any ridentifier 1487960029 keep state  label "USER_RULE: Ping"
                    

                    Oops after I changed it to lan3 net

                    pass  in log  quick  on $LAN3 inet6 proto tcp  from $Yellow_Network to $Green_Network port 3389 ridentifier 1631863185 flags S/SA keep state  label "USER_RULE: RDP"
                    **# source address is empty.  label "USER_RULE: Ping"
                    # source address is empty.  label "USER_RULE: Ping"**
                    pass  in  quick  on $LAN3 inet proto tcp  from $Yellow_Network to $AD_Controller port $AD_TCP ridentifier 1630087169 flags S/SA keep state  label "USER_RULE: Ad Kommunikation TCP"
                    

                    21-07-_2022_21-41-05.jpg
                    21-07-_2022_21-41-27.jpg

                    1 Reply Last reply Reply Quote 0
                    • T
                      Tobi @johnpoz
                      last edited by Jul 21, 2022, 7:44 PM

                      @johnpoz said in Is it possible to change an alias dynamically?:

                      are you doing anything with captive portal settings?

                      No newer

                      J 1 Reply Last reply Jul 21, 2022, 7:49 PM Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator @Tobi
                        last edited by johnpoz Jul 21, 2022, 7:51 PM Jul 21, 2022, 7:49 PM

                        @tobi so for whatever reason lan3 net is not populated.. Hmmmm??? That would for sure explain why it doesn't work.

                        edit: Wonder if maybe the IPv6 isn't working and that causing a problem.. Could you try turning off the IPv6 on this interface and then looking at the rules when set to Lan3 net.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        T 2 Replies Last reply Jul 21, 2022, 7:50 PM Reply Quote 0
                        • T
                          Tobi @johnpoz
                          last edited by Jul 21, 2022, 7:50 PM

                          @johnpoz said in Is it possible to change an alias dynamically?:

                          That would for sure explain why it doesn't work.

                          I think so but I have absolut no idea whats going wrong here :(

                          J 1 Reply Last reply Jul 21, 2022, 7:51 PM Reply Quote 0
                          • J
                            johnpoz LAYER 8 Global Moderator @Tobi
                            last edited by Jul 21, 2022, 7:51 PM

                            @tobi see my edit - maybe try it with ipv6 turned off on the interface.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            1 Reply Last reply Reply Quote 0
                            • T
                              Tobi @johnpoz
                              last edited by Jul 21, 2022, 7:53 PM

                              @johnpoz said in Is it possible to change an alias dynamically?:

                              Wonder if maybe the IPv6 isn't working and that causing a problem..

                              IPv6 is working very well.

                              I can chack what happens if I disable "track" WAN Interface for IPv6 for this interface

                              J 1 Reply Last reply Jul 21, 2022, 7:58 PM Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator @Tobi
                                last edited by Jul 21, 2022, 7:58 PM

                                @tobi yeah just grasping at straws on why when you pick lan3 net that says no source defined.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                T 1 Reply Last reply Jul 21, 2022, 8:04 PM Reply Quote 0
                                • T
                                  Tobi
                                  last edited by Jul 21, 2022, 7:59 PM

                                  @johnpoz said in Is it possible to change an alias dynamically?:

                                  maybe try it with ipv6 turned off on the interface.

                                  This chances nothing

                                  # source address is empty.  label "USER_RULE: Ping"
                                  # source address is empty.  label "USER_RULE: Ping"
                                  
                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    Tobi @johnpoz
                                    last edited by Tobi Jul 21, 2022, 8:06 PM Jul 21, 2022, 8:04 PM

                                    @johnpoz said in Is it possible to change an alias dynamically?:

                                    yeah just grasping at straws on why when you pick lan3 net that says no source defined.

                                    Yes it's true but this happens with each interface/ LanX Net I'm trying. Not only lan3

                                    And If I try to modiify the Rule

                                    Ping from Yellow_Network to LAN4 Net then in in rules.debug I see "destination address is empty"

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      stephenw10 Netgate Administrator
                                      last edited by Jul 21, 2022, 9:18 PM

                                      Hmm... well that's extremely odd!

                                      This is in pfSense 2.6?

                                      Are you using any of the System Aliases (LANx Net) in any firewall rules successfully?

                                      Do you see the 'system aliases' section in the rules.debug file?
                                      Is LAN3 referencing the correct interface?
                                      I expect both those to be true because the traffic is being blocked correctly still.

                                      Try adding the v4 and v6 rules as separate lines in the config.
                                      The scripts create then as separate rules line anyway but it could be trying to validate the LANx net alias as both v4 and v6 at the same time and failing both somehow.

                                      Steve

                                      T 1 Reply Last reply Jul 22, 2022, 6:49 AM Reply Quote 0
                                      • T
                                        Tobi @stephenw10
                                        last edited by Tobi Jul 22, 2022, 6:57 AM Jul 22, 2022, 6:49 AM

                                        @stephenw10 said in Is it possible to change an alias dynamically?:

                                        This is in pfSense 2.6?

                                        Yes
                                        22-07-_2022_08-56-52.jpg

                                        @stephenw10 said in Is it possible to change an alias dynamically?:

                                        Are you using any of the System Aliases (LANx Net) in any firewall rules successfully?

                                        No.

                                        @stephenw10 said in Is it possible to change an alias dynamically?:

                                        Do you see the 'system aliases' section in the rules.debug file?

                                        #System aliases
                                        
                                        loopback = "{ lo0 }"
                                        WAN = "{ pppoe0 }"
                                        LAN0 = "{ igb1 }"
                                        LAN1 = "{ igb2 }"
                                        LAN2 = "{ igb3 }"
                                        LAN3 = "{ igb4 }"
                                        LAN4 = "{ igb3.150 }"
                                        LAN5 = "{ igb3.250 }"
                                        LAN6 = "{ igb3.20 }"
                                        LAN7 = "{ igb2.30 }"
                                        LAN8 = "{ igb2.40 }"
                                        LAN9 = "{ igb2.50 }"
                                        OpenVPN = "{ openvpn }"
                                        
                                        

                                        @stephenw10 said in Is it possible to change an alias dynamically?:

                                        Try adding the v4 and v6 rules as separate lines in the config.

                                        Yesterday I tryed to disable ipv6 from this interface and create also a new rule only for IPv4 - nothing changes

                                        T 1 Reply Last reply Jul 22, 2022, 9:43 AM Reply Quote 0
                                        • T
                                          Tobi @Tobi
                                          last edited by Jul 22, 2022, 9:43 AM

                                          The only thing with system alias works here is my WAN Interface. I can create rule with "WAN Net" oder "WAN Address" and this works, but no other interfaces.

                                          1 Reply Last reply Reply Quote 0
                                          • T Tobi referenced this topic on Jul 22, 2022, 7:03 PM
                                          46 out of 46
                                          • First post
                                            46/46
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received