• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

error loading rules proto ipv6 from any to any

Scheduled Pinned Locked Moved General pfSense Questions
19 Posts 5 Posters 1.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • A
    ACalcutt
    last edited by ACalcutt Apr 12, 2023, 1:02 PM Apr 12, 2023, 1:01 PM

    Hi Everyone,

    I have a Netgate 3100. Since upgrading to 23.01 I have been getting lots of this rule error

    There were error(s) loading the rules: /tmp/rules.debug:95: syntax error - The line in question reads [95]: rdr on $WAN1 proto ipv6 from any to any -
    

    When I look at Firewall rules on WAN1 I don't see any ipv6 rules. Is there another way for me to see what this rule is?

    1 Reply Last reply Reply Quote 0
    • S
      stephenw10 Netgate Administrator
      last edited by Apr 12, 2023, 1:32 PM

      That's a NAT rule, a port forward. And it looks like it's only partially configured so is invalid.
      Not sure how that might have happened.

      Steve

      1 Reply Last reply Reply Quote 0
      • A
        ACalcutt
        last edited by Apr 13, 2023, 12:29 AM

        Seems like it is these nat rules I had put in place for xbox. I disabled them and that rule error seems to have stopped. strangly, I went into them and made them ipv4 family only and I still got the 'pv6 from any to any' message.

        abe3a99a-277a-426f-ba5b-cad6ceb00074-image.png

        A 1 Reply Last reply May 27, 2023, 10:53 AM Reply Quote 0
        • A
          ACalcutt @ACalcutt
          last edited by May 27, 2023, 10:53 AM

          After more time testing I wanted to mention, disabling those rules did not fix my issue and I ended up putting them back. I was getting the error in my OP either way.

          1 Reply Last reply Reply Quote 0
          • S
            stephenw10 Netgate Administrator
            last edited by May 27, 2023, 8:58 PM

            Are you still seeing the same errors in 23.05?

            A 1 Reply Last reply Jun 3, 2023, 2:21 PM Reply Quote 0
            • A
              ACalcutt @stephenw10
              last edited by Jun 3, 2023, 2:21 PM

              @stephenw10

              yes they are still happening in 23.05

              7e252d9d-d222-4791-ae0f-5ba2b8f01e1c-image.png

              J 1 Reply Last reply Jun 3, 2023, 3:24 PM Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator @ACalcutt
                last edited by Jun 3, 2023, 3:24 PM

                @ACalcutt and what do you show in your port forward rules - a rdr is a port forward. You shouldn't be port forwarding IPv6

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                A 1 Reply Last reply Jun 3, 2023, 3:33 PM Reply Quote 0
                • A
                  ACalcutt @johnpoz
                  last edited by Jun 3, 2023, 3:33 PM

                  @johnpoz

                  My WAN1 is a IPv4 only interface.

                  Like these port forwarding rules under NAT?

                  702f35e6-c83e-4fcc-a264-e8e3240497f8-image.png

                  Or the rules for that interface?
                  8a94a00b-4ca8-4e32-8d81-25e546b8cb5a-image.png

                  S J 2 Replies Last reply Jun 3, 2023, 3:39 PM Reply Quote 0
                  • S
                    SteveITS Galactic Empire @ACalcutt
                    last edited by Jun 3, 2023, 3:39 PM

                    @ACalcutt from https://docs.netgate.com/pfsense/en/latest/troubleshooting/firewall.html#ruleset-failing-to-load:

                    The ruleset can also be verified from the console or Diagnostics > Command in the Shell Execute box by running:

                    pfctl -f /tmp/rules.debug

                    And/or view the rules.debug file.

                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                    Upvote 👍 helpful posts!

                    A 1 Reply Last reply Jun 3, 2023, 3:57 PM Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator @ACalcutt
                      last edited by Jun 3, 2023, 3:42 PM

                      @ACalcutt well seems like something is stuck there - maybe from before doing something would look into what @SteveITS points out and clear up that entry in your rules - because it sure shouldn't be there anyway.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • A
                        ACalcutt @SteveITS
                        last edited by ACalcutt Jun 3, 2023, 3:57 PM Jun 3, 2023, 3:57 PM

                        @SteveITS said in error loading rules proto ipv6 from any to any:

                        https://docs.netgate.com/pfsense/en/latest/troubleshooting/firewall.html#ruleset-failing-to-load

                        In the rules.debug generated I see this line, which I assume is what it is complaining about

                        # TFTP proxy
                        rdr-anchor "tftp-proxy/*"
                        rdr on $WAN1 proto ipv6 from any to any ->
                        

                        I don't recall setting up a tftp proxy... any idea where that is set up? how do I actually get rid of it?

                        J 1 Reply Last reply Jun 3, 2023, 4:31 PM Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator @ACalcutt
                          last edited by johnpoz Jun 3, 2023, 4:34 PM Jun 3, 2023, 4:31 PM

                          @ACalcutt tftp is not the problem..

                          I don't have tftp enabled - that rule is going to be there by defult.. But you shouldn't have that rdr for ipv6

                          Here is that section of mine for example

                          # TFTP proxy
                          rdr-anchor "tftp-proxy/*"
                          # NAT Inbound Redirects
                          rdr on igb1 inet proto tcp from $pfB_AllowPfb_v4 to 209.snipped port 23040 -> 192.168.9.10 port 32400
                          rdr on igb2.4 inet proto { tcp udp } from 192.168.4.0/24 to any port 53 -> 192.168.3.10
                          no nat on igb2.4 inet proto tcp from (igb2.4) to 192.168.4.0/24
                          nat on igb2.4 inet proto tcp from 192.168.4.0/24 to 192.168.3.10 port 53 -> (igb2.4)
                          

                          I snipped out my public IP.

                          I would prob do an export of your rules xml via diagnostics backup and restore.. Do you see that bad entry in there, edit the xml to remove it and then restore the xml.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          A 1 Reply Last reply Jun 3, 2023, 5:27 PM Reply Quote 0
                          • A
                            ACalcutt @johnpoz
                            last edited by Jun 3, 2023, 5:27 PM

                            @johnpoz

                            Looking through the backup config xml I don't see a rule on wan that is source and destination any. I was looking for a rule on wan that had both

                            <source>
                            	<any></any>
                            </source>
                            <destination>
                            	<any></any>
                            </destination>
                            

                            The closest was the icmp rule that relates to my ipv6 tunnel , but that rule is only ipv4 when i look at it

                            I tried just reloading the config, but no luck there. there error is still happening.

                            J 1 Reply Last reply Jun 3, 2023, 7:08 PM Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator @ACalcutt
                              last edited by Jun 3, 2023, 7:08 PM

                              @ACalcutt My bad - this is a issue with rdr, so its prob in your nat part of your config.. Download that section and look for the section of the xml that has the bad info.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • S
                                stephenw10 Netgate Administrator
                                last edited by Jun 4, 2023, 12:30 PM

                                You have any NPt rules?

                                A 1 Reply Last reply Jun 4, 2023, 2:07 PM Reply Quote 0
                                • A
                                  ACalcutt @stephenw10
                                  last edited by Jun 4, 2023, 2:07 PM

                                  @stephenw10 , no no NPt rules

                                  @johnpoz looking though the nat section I'm not seeing where this rule comes from. Maybe it is an auto generated one? I attached my nat config
                                  if someone wanted to give it another set of eyes....I really only have a few entries for PS4/XBOX and some entries for FTP

                                  nat-config-pfSense.eiri.lan-20230604135911.xml

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    stephenw10 Netgate Administrator
                                    last edited by Jun 5, 2023, 1:11 PM

                                    If it's an auto generated rule I'd check the NAT reflection settings. Either globally or for each forward.

                                    However it's unlikely either of those would be v6 or any/any.

                                    Where does that rule actually appear in the generated ruleset?

                                    J 1 Reply Last reply Jun 11, 2023, 2:36 AM Reply Quote 0
                                    • J
                                      jpmchia @stephenw10
                                      last edited by Jun 11, 2023, 2:36 AM

                                      I've encountered / still experiencing the same issue and after 3 clean reinstalls have managed to identify the cause.

                                      It's being generated by the: "Enable IPv6 over IPv4 tunneling" option.

                                      Unchecking it clears the error but have experienced a number of issues with IPv6 functionality since doing so - we have both direct IPv6 uplinks but also use 6in4 tunnels.

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        ACalcutt
                                        last edited by Jun 11, 2023, 5:20 AM

                                        I am also using IPv6 over IPv4 here, so that makes sense.

                                        I ended up moving back to 22.05 and restoring my backup from before that upgrade for now. This error was annoying, but what pushed me was a spent a day trying to get multiwan failover that was working before working in 23.05 and just couldn't get it to actually fail over like it should. worked instantly in 22.05 . maybe after a few more releases I'll give 23.x another shot, but for now I just need this to work as expected.

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                          [[user:consent.lead]]
                                          [[user:consent.not_received]]