• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Is it possible to change an alias dynamically?

Scheduled Pinned Locked Moved Firewalling
46 Posts 6 Posters 6.6k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    johnpoz LAYER 8 Global Moderator @Tobi
    last edited by Jul 21, 2022, 7:28 PM

    @tobi I really want to see what the actual rules look like when you change to X net.. Are they just not populating anything, some wrong cidr?

    An intelligent man is sometimes forced to be drunk to spend time with his fools
    If you get confused: Listen to the Music Play
    Please don't Chat/PM me for help, unless mod related
    SG-4860 24.11 | Lab VMs 2.8, 24.11

    1 Reply Last reply Reply Quote 0
    • T
      Tobi @johnpoz
      last edited by Tobi Jul 21, 2022, 7:42 PM Jul 21, 2022, 7:32 PM

      @johnpoz said in Is it possible to change an alias dynamically?:

      So look at your rules when set as yellow_network alias with

      pass  in  quick  on $LAN3 inet proto icmp  from $Yellow_Network to any ridentifier 1487960029 keep state  label "USER_RULE: Ping"
      pass  in  quick  on $LAN3 inet6 proto ipv6-icmp  from $Yellow_Network to any ridentifier 1487960029 keep state  label "USER_RULE: Ping"
      

      Oops after I changed it to lan3 net

      pass  in log  quick  on $LAN3 inet6 proto tcp  from $Yellow_Network to $Green_Network port 3389 ridentifier 1631863185 flags S/SA keep state  label "USER_RULE: RDP"
      **# source address is empty.  label "USER_RULE: Ping"
      # source address is empty.  label "USER_RULE: Ping"**
      pass  in  quick  on $LAN3 inet proto tcp  from $Yellow_Network to $AD_Controller port $AD_TCP ridentifier 1630087169 flags S/SA keep state  label "USER_RULE: Ad Kommunikation TCP"
      

      21-07-_2022_21-41-05.jpg
      21-07-_2022_21-41-27.jpg

      1 Reply Last reply Reply Quote 0
      • T
        Tobi @johnpoz
        last edited by Jul 21, 2022, 7:44 PM

        @johnpoz said in Is it possible to change an alias dynamically?:

        are you doing anything with captive portal settings?

        No newer

        J 1 Reply Last reply Jul 21, 2022, 7:49 PM Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator @Tobi
          last edited by johnpoz Jul 21, 2022, 7:51 PM Jul 21, 2022, 7:49 PM

          @tobi so for whatever reason lan3 net is not populated.. Hmmmm??? That would for sure explain why it doesn't work.

          edit: Wonder if maybe the IPv6 isn't working and that causing a problem.. Could you try turning off the IPv6 on this interface and then looking at the rules when set to Lan3 net.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          T 2 Replies Last reply Jul 21, 2022, 7:50 PM Reply Quote 0
          • T
            Tobi @johnpoz
            last edited by Jul 21, 2022, 7:50 PM

            @johnpoz said in Is it possible to change an alias dynamically?:

            That would for sure explain why it doesn't work.

            I think so but I have absolut no idea whats going wrong here :(

            J 1 Reply Last reply Jul 21, 2022, 7:51 PM Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator @Tobi
              last edited by Jul 21, 2022, 7:51 PM

              @tobi see my edit - maybe try it with ipv6 turned off on the interface.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • T
                Tobi @johnpoz
                last edited by Jul 21, 2022, 7:53 PM

                @johnpoz said in Is it possible to change an alias dynamically?:

                Wonder if maybe the IPv6 isn't working and that causing a problem..

                IPv6 is working very well.

                I can chack what happens if I disable "track" WAN Interface for IPv6 for this interface

                J 1 Reply Last reply Jul 21, 2022, 7:58 PM Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator @Tobi
                  last edited by Jul 21, 2022, 7:58 PM

                  @tobi yeah just grasping at straws on why when you pick lan3 net that says no source defined.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  T 1 Reply Last reply Jul 21, 2022, 8:04 PM Reply Quote 0
                  • T
                    Tobi
                    last edited by Jul 21, 2022, 7:59 PM

                    @johnpoz said in Is it possible to change an alias dynamically?:

                    maybe try it with ipv6 turned off on the interface.

                    This chances nothing

                    # source address is empty.  label "USER_RULE: Ping"
                    # source address is empty.  label "USER_RULE: Ping"
                    
                    1 Reply Last reply Reply Quote 0
                    • T
                      Tobi @johnpoz
                      last edited by Tobi Jul 21, 2022, 8:06 PM Jul 21, 2022, 8:04 PM

                      @johnpoz said in Is it possible to change an alias dynamically?:

                      yeah just grasping at straws on why when you pick lan3 net that says no source defined.

                      Yes it's true but this happens with each interface/ LanX Net I'm trying. Not only lan3

                      And If I try to modiify the Rule

                      Ping from Yellow_Network to LAN4 Net then in in rules.debug I see "destination address is empty"

                      1 Reply Last reply Reply Quote 0
                      • S
                        stephenw10 Netgate Administrator
                        last edited by Jul 21, 2022, 9:18 PM

                        Hmm... well that's extremely odd!

                        This is in pfSense 2.6?

                        Are you using any of the System Aliases (LANx Net) in any firewall rules successfully?

                        Do you see the 'system aliases' section in the rules.debug file?
                        Is LAN3 referencing the correct interface?
                        I expect both those to be true because the traffic is being blocked correctly still.

                        Try adding the v4 and v6 rules as separate lines in the config.
                        The scripts create then as separate rules line anyway but it could be trying to validate the LANx net alias as both v4 and v6 at the same time and failing both somehow.

                        Steve

                        T 1 Reply Last reply Jul 22, 2022, 6:49 AM Reply Quote 0
                        • T
                          Tobi @stephenw10
                          last edited by Tobi Jul 22, 2022, 6:57 AM Jul 22, 2022, 6:49 AM

                          @stephenw10 said in Is it possible to change an alias dynamically?:

                          This is in pfSense 2.6?

                          Yes
                          22-07-_2022_08-56-52.jpg

                          @stephenw10 said in Is it possible to change an alias dynamically?:

                          Are you using any of the System Aliases (LANx Net) in any firewall rules successfully?

                          No.

                          @stephenw10 said in Is it possible to change an alias dynamically?:

                          Do you see the 'system aliases' section in the rules.debug file?

                          #System aliases
                          
                          loopback = "{ lo0 }"
                          WAN = "{ pppoe0 }"
                          LAN0 = "{ igb1 }"
                          LAN1 = "{ igb2 }"
                          LAN2 = "{ igb3 }"
                          LAN3 = "{ igb4 }"
                          LAN4 = "{ igb3.150 }"
                          LAN5 = "{ igb3.250 }"
                          LAN6 = "{ igb3.20 }"
                          LAN7 = "{ igb2.30 }"
                          LAN8 = "{ igb2.40 }"
                          LAN9 = "{ igb2.50 }"
                          OpenVPN = "{ openvpn }"
                          
                          

                          @stephenw10 said in Is it possible to change an alias dynamically?:

                          Try adding the v4 and v6 rules as separate lines in the config.

                          Yesterday I tryed to disable ipv6 from this interface and create also a new rule only for IPv4 - nothing changes

                          T 1 Reply Last reply Jul 22, 2022, 9:43 AM Reply Quote 0
                          • T
                            Tobi @Tobi
                            last edited by Jul 22, 2022, 9:43 AM

                            The only thing with system alias works here is my WAN Interface. I can create rule with "WAN Net" oder "WAN Address" and this works, but no other interfaces.

                            1 Reply Last reply Reply Quote 0
                            • T Tobi referenced this topic on Jul 22, 2022, 7:03 PM
                            46 out of 46
                            • First post
                              46/46
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                              This community forum collects and processes your personal information.
                              consent.not_received