• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

error loading rules proto ipv6 from any to any

Scheduled Pinned Locked Moved General pfSense Questions
19 Posts 5 Posters 1.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    SteveITS Galactic Empire @ACalcutt
    last edited by Jun 3, 2023, 3:39 PM

    @ACalcutt from https://docs.netgate.com/pfsense/en/latest/troubleshooting/firewall.html#ruleset-failing-to-load:

    The ruleset can also be verified from the console or Diagnostics > Command in the Shell Execute box by running:

    pfctl -f /tmp/rules.debug

    And/or view the rules.debug file.

    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
    Upvote 👍 helpful posts!

    A 1 Reply Last reply Jun 3, 2023, 3:57 PM Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator @ACalcutt
      last edited by Jun 3, 2023, 3:42 PM

      @ACalcutt well seems like something is stuck there - maybe from before doing something would look into what @SteveITS points out and clear up that entry in your rules - because it sure shouldn't be there anyway.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • A
        ACalcutt @SteveITS
        last edited by ACalcutt Jun 3, 2023, 3:57 PM Jun 3, 2023, 3:57 PM

        @SteveITS said in error loading rules proto ipv6 from any to any:

        https://docs.netgate.com/pfsense/en/latest/troubleshooting/firewall.html#ruleset-failing-to-load

        In the rules.debug generated I see this line, which I assume is what it is complaining about

        # TFTP proxy
        rdr-anchor "tftp-proxy/*"
        rdr on $WAN1 proto ipv6 from any to any ->
        

        I don't recall setting up a tftp proxy... any idea where that is set up? how do I actually get rid of it?

        J 1 Reply Last reply Jun 3, 2023, 4:31 PM Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator @ACalcutt
          last edited by johnpoz Jun 3, 2023, 4:34 PM Jun 3, 2023, 4:31 PM

          @ACalcutt tftp is not the problem..

          I don't have tftp enabled - that rule is going to be there by defult.. But you shouldn't have that rdr for ipv6

          Here is that section of mine for example

          # TFTP proxy
          rdr-anchor "tftp-proxy/*"
          # NAT Inbound Redirects
          rdr on igb1 inet proto tcp from $pfB_AllowPfb_v4 to 209.snipped port 23040 -> 192.168.9.10 port 32400
          rdr on igb2.4 inet proto { tcp udp } from 192.168.4.0/24 to any port 53 -> 192.168.3.10
          no nat on igb2.4 inet proto tcp from (igb2.4) to 192.168.4.0/24
          nat on igb2.4 inet proto tcp from 192.168.4.0/24 to 192.168.3.10 port 53 -> (igb2.4)
          

          I snipped out my public IP.

          I would prob do an export of your rules xml via diagnostics backup and restore.. Do you see that bad entry in there, edit the xml to remove it and then restore the xml.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          A 1 Reply Last reply Jun 3, 2023, 5:27 PM Reply Quote 0
          • A
            ACalcutt @johnpoz
            last edited by Jun 3, 2023, 5:27 PM

            @johnpoz

            Looking through the backup config xml I don't see a rule on wan that is source and destination any. I was looking for a rule on wan that had both

            <source>
            	<any></any>
            </source>
            <destination>
            	<any></any>
            </destination>
            

            The closest was the icmp rule that relates to my ipv6 tunnel , but that rule is only ipv4 when i look at it

            I tried just reloading the config, but no luck there. there error is still happening.

            J 1 Reply Last reply Jun 3, 2023, 7:08 PM Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator @ACalcutt
              last edited by Jun 3, 2023, 7:08 PM

              @ACalcutt My bad - this is a issue with rdr, so its prob in your nat part of your config.. Download that section and look for the section of the xml that has the bad info.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • S
                stephenw10 Netgate Administrator
                last edited by Jun 4, 2023, 12:30 PM

                You have any NPt rules?

                A 1 Reply Last reply Jun 4, 2023, 2:07 PM Reply Quote 0
                • A
                  ACalcutt @stephenw10
                  last edited by Jun 4, 2023, 2:07 PM

                  @stephenw10 , no no NPt rules

                  @johnpoz looking though the nat section I'm not seeing where this rule comes from. Maybe it is an auto generated one? I attached my nat config
                  if someone wanted to give it another set of eyes....I really only have a few entries for PS4/XBOX and some entries for FTP

                  nat-config-pfSense.eiri.lan-20230604135911.xml

                  1 Reply Last reply Reply Quote 0
                  • S
                    stephenw10 Netgate Administrator
                    last edited by Jun 5, 2023, 1:11 PM

                    If it's an auto generated rule I'd check the NAT reflection settings. Either globally or for each forward.

                    However it's unlikely either of those would be v6 or any/any.

                    Where does that rule actually appear in the generated ruleset?

                    J 1 Reply Last reply Jun 11, 2023, 2:36 AM Reply Quote 0
                    • J
                      jpmchia @stephenw10
                      last edited by Jun 11, 2023, 2:36 AM

                      I've encountered / still experiencing the same issue and after 3 clean reinstalls have managed to identify the cause.

                      It's being generated by the: "Enable IPv6 over IPv4 tunneling" option.

                      Unchecking it clears the error but have experienced a number of issues with IPv6 functionality since doing so - we have both direct IPv6 uplinks but also use 6in4 tunnels.

                      1 Reply Last reply Reply Quote 0
                      • A
                        ACalcutt
                        last edited by Jun 11, 2023, 5:20 AM

                        I am also using IPv6 over IPv4 here, so that makes sense.

                        I ended up moving back to 22.05 and restoring my backup from before that upgrade for now. This error was annoying, but what pushed me was a spent a day trying to get multiwan failover that was working before working in 23.05 and just couldn't get it to actually fail over like it should. worked instantly in 22.05 . maybe after a few more releases I'll give 23.x another shot, but for now I just need this to work as expected.

                        1 Reply Last reply Reply Quote 0
                        18 out of 19
                        • First post
                          18/19
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                          This community forum collects and processes your personal information.
                          consent.not_received