error loading rules proto ipv6 from any to any

[ACalcutt]

Hi Everyone,

I have a Netgate 3100. Since upgrading to 23.01 I have been getting lots of this rule error

There were error(s) loading the rules: /tmp/rules.debug:95: syntax error - The line in question reads [95]: rdr on $WAN1 proto ipv6 from any to any -

When I look at Firewall rules on WAN1 I don't see any ipv6 rules. Is there another way for me to see what this rule is?

[stephenw10]

That's a NAT rule, a port forward. And it looks like it's only partially configured so is invalid.
Not sure how that might have happened.

Steve

[ACalcutt]

Seems like it is these nat rules I had put in place for xbox. I disabled them and that rule error seems to have stopped. strangly, I went into them and made them ipv4 family only and I still got the 'pv6 from any to any' message.

[ACalcutt]

After more time testing I wanted to mention, disabling those rules did not fix my issue and I ended up putting them back. I was getting the error in my OP either way.

[stephenw10]

Are you still seeing the same errors in 23.05?

[ACalcutt]

@stephenw10

yes they are still happening in 23.05

[johnpoz]

@ACalcutt and what do you show in your port forward rules - a rdr is a port forward. You shouldn't be port forwarding IPv6

[ACalcutt]

@johnpoz

My WAN1 is a IPv4 only interface.

Like these port forwarding rules under NAT?

Or the rules for that interface?

[SteveITS]

@ACalcutt from https://docs.netgate.com/pfsense/en/latest/troubleshooting/firewall.html#ruleset-failing-to-load:

The ruleset can also be verified from the console or Diagnostics > Command in the Shell Execute box by running:

pfctl -f /tmp/rules.debug

And/or view the rules.debug file.

[johnpoz]

@ACalcutt well seems like something is stuck there - maybe from before doing something would look into what @SteveITS points out and clear up that entry in your rules - because it sure shouldn't be there anyway.

[ACalcutt]

@SteveITS said in error loading rules proto ipv6 from any to any:

https://docs.netgate.com/pfsense/en/latest/troubleshooting/firewall.html#ruleset-failing-to-load

In the rules.debug generated I see this line, which I assume is what it is complaining about

# TFTP proxy
rdr-anchor "tftp-proxy/*"
rdr on $WAN1 proto ipv6 from any to any ->

I don't recall setting up a tftp proxy... any idea where that is set up? how do I actually get rid of it?

[johnpoz]

@ACalcutt tftp is not the problem..

I don't have tftp enabled - that rule is going to be there by defult.. But you shouldn't have that rdr for ipv6

Here is that section of mine for example

# TFTP proxy
rdr-anchor "tftp-proxy/*"
# NAT Inbound Redirects
rdr on igb1 inet proto tcp from $pfB_AllowPfb_v4 to 209.snipped port 23040 -> 192.168.9.10 port 32400
rdr on igb2.4 inet proto { tcp udp } from 192.168.4.0/24 to any port 53 -> 192.168.3.10
no nat on igb2.4 inet proto tcp from (igb2.4) to 192.168.4.0/24
nat on igb2.4 inet proto tcp from 192.168.4.0/24 to 192.168.3.10 port 53 -> (igb2.4)

I snipped out my public IP.

I would prob do an export of your rules xml via diagnostics backup and restore.. Do you see that bad entry in there, edit the xml to remove it and then restore the xml.

[ACalcutt]

@johnpoz

Looking through the backup config xml I don't see a rule on wan that is source and destination any. I was looking for a rule on wan that had both

<source>
	<any></any>
</source>
<destination>
	<any></any>
</destination>

The closest was the icmp rule that relates to my ipv6 tunnel , but that rule is only ipv4 when i look at it

I tried just reloading the config, but no luck there. there error is still happening.

[johnpoz]

@ACalcutt My bad - this is a issue with rdr, so its prob in your nat part of your config.. Download that section and look for the section of the xml that has the bad info.

[stephenw10]

You have any NPt rules?

[ACalcutt]

@stephenw10 , no no NPt rules

@johnpoz looking though the nat section I'm not seeing where this rule comes from. Maybe it is an auto generated one? I attached my nat config
if someone wanted to give it another set of eyes....I really only have a few entries for PS4/XBOX and some entries for FTP

nat-config-pfSense.eiri.lan-20230604135911.xml

[stephenw10]

If it's an auto generated rule I'd check the NAT reflection settings. Either globally or for each forward.

However it's unlikely either of those would be v6 or any/any.

Where does that rule actually appear in the generated ruleset?

[jpmchia]

I've encountered / still experiencing the same issue and after 3 clean reinstalls have managed to identify the cause.

It's being generated by the: "Enable IPv6 over IPv4 tunneling" option.

Unchecking it clears the error but have experienced a number of issues with IPv6 functionality since doing so - we have both direct IPv6 uplinks but also use 6in4 tunnels.

[ACalcutt]

I am also using IPv6 over IPv4 here, so that makes sense.

I ended up moving back to 22.05 and restoring my backup from before that upgrade for now. This error was annoying, but what pushed me was a spent a day trying to get multiwan failover that was working before working in 23.05 and just couldn't get it to actually fail over like it should. worked instantly in 22.05 . maybe after a few more releases I'll give 23.x another shot, but for now I just need this to work as expected.