pfSense not propagating "system aliases" (lanX net/ lanX address)

Tobi

Hello,

depends on my "old" thread I think it's better to start a new one with now correct topic.

Ols topic was here Link Text

If I try to create a rule with source and/ or destination lanX net/ lanX address then this rule is not working and cat /tmp/rules.debug mean always:

# destination address is empty

or

# source address is empty

This kind of rules works here only for my wan interface and in /tmp directory I see only for my wan/ pppoe interface entries like:

-rw-r--r--   1 root  wheel      19 Jul 22 11:24 pppoe0_ip
-rw-r--r--   1 root  wheel      26 Jul 22 11:24 pppoe0_ipv6

with IP addresses

johnpoz

@tobi yeah prob good idea to start a anew thread on this.

Just to add info.. You also created just IPv4 rules and same thing was happening right, in the old thread your rules were all IPv4+6, but you specifically made just a IPv4 rule and was still happening.

Tobi

@johnpoz - yes I tried some combinations

only ipv4 rule
only ipv6 rufe
disable ipv6 "track wan interface" on lan X interface.

nothing of this changes changed something

johnpoz

@tobi While this might be drastic, and could prevent us from finding the root cause.

Would you be up for redo of pfsense.. Be really curious if you backed up the config. Then did a clean install - does it work normal? Just really vanilla wan/lan and and then add another interface, etc.

And then restore you config, and does it then fail again?

Tobi

@johnpoz - I don't think I'm ready to take that step. As long as I have to work from home, I can't sit down offline.
Is there a place where you can see the system aliases and the IP configuration for them?

johnpoz

@tobi said in pfSense not propagating "system aliases" (lanX net/ lanX address):

system aliases and the IP configuration for them?

Not that I am aware of - you can view tables that are used - but not exactly sure the address and nets are parsed or where from.. Maybe its in the xml file? And yours is corrupt, but those are not actual table values that you can view with day diag menu, tables.

That is why I had called @stephenw10 and @Derelict into the previous thread - thought they might have some ideas on where to exactly check, and might know how that gets filled in when you use them in a rule, etc. off the top of their heads sort of thing - I would have to dig into that.

I have never seen such an issue before. Been on the forums long long time, and I don't recall ever seeing anything like this or even close to it before.

My thought was something with the IPv6 and IPv4 thing might be cause - but clearly that is not the case because you have the same issue with just IPv4 rule - and clearly from the actual rules looking at, for whatever reason pfsense is not parsing these values like it should.

edit:
I looked in the config, and really the only thing that jumps out at me at where that info is stored is in the interfaces section.. like so

<lan>
			<enable></enable>
			<if>igb0</if>
			<descr><![CDATA[LAN]]></descr>
			<spoofmac></spoofmac>
			<ipaddr>192.168.9.253</ipaddr>
			<subnet>24</subnet>
			<ipaddrv6>2001:470:snipped::253</ipaddrv6>
			<subnetv6>64</subnetv6>
		</lan>

So there is some method that parses that info when firewall rules are created - why its failing on yours is odd for sure..

Have to look through the code for when a firewall rule is created to how it determines the address or the net..

While you have a working work around, with your created aliases - really should get to why/how this even happening..

stephenw10

Are you able to send us diag info from that firewall to investigate further?

Tobi

@stephenw10 - Sure, I can do it with pleasure. Unfortunately, I don't know exactly what you mean by that. Where/how do I find the diag info?

Tobi

@johnpoz said in pfSense not propagating "system aliases" (lanX net/ lanX address):

I looked in the config, a

I wanted to post a part from the interface section but always get a message that it is detected as spam.

Tobi

I looked at my old box. It was last equipped with 2.5.2. There it works.
However, the old box I can not put into operation, because it has much fewer ports and the configuration no longer fits. The configuration on the new box I had then taken over from the old.

(at the opportunity - is there a way to reload the filters via the CLI?)

johnpoz

@tobi said in pfSense not propagating "system aliases" (lanX net/ lanX address):

The configuration on the new box I had then taken over from the old.

So you loaded the xml from the old into the new?

Tobi

@johnpoz said in pfSense not propagating "system aliases" (lanX net/ lanX address):

So you loaded the xml from the old into the new?

In first part yes. Later I changed many things - because the new one has more interfaces.

johnpoz

@tobi hmmm - issue could be related to that method??

Would be good test to do a clean install, does it work.. Then restore you backup config.. But as you mentioned your not to that stage yet.

But I am not sure where to go next with this, other then clean install, and then restore of config to see if creates the problem.

Maybe @stephenw10 has some stuff to check? I am at a loss to what could cause this.. But I am not completely sure on all the things involved on how it parses out the variables in the rules for address and net.

But clearly its working as far as interfaces, or your work around of your own aliases with the cidr network in them wouldn't be working either

Tobi

@johnpoz Thank you.
Do you have any idea where/how I can get the diag info that @stephenw10 is asking for?

johnpoz

@tobi not sure what he is asking for.. Sure he will chime in on specifics soon enough.. Just give him some time - it is the weekend ;)

SteveITS

@tobi I think he means
https://docs.netgate.com/pfsense/en/latest/recipes/diagnostic-data.html

johnpoz

@steveits yup - that would most likely be it for sure..

Tobi

@steveits said in pfSense not propagating "system aliases" (lanX net/ lanX address):

I think he means

Yes it makes sense. However, I will wait for his answer, because in the whole diag I think there is too much data that does not belong in a public forum.
Maybe he mean "only" the Firewall-*.txt files

johnpoz

@tobi you can for sure that file just to @stephenw10

stephenw10

Yes, exactly that. If you can gather the status output file from that page you can upload it to me here: https://nc.netgate.com/nextcloud/s/bTgFR9wa8MAcGij

Steve