• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Why are Virtual IPs not considered part of their interface net for firewall rules?

Scheduled Pinned Locked Moved Firewalling
7 Posts 4 Posters 564 Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • O
    OffstageRoller
    last edited by OffstageRoller Mar 13, 2024, 6:19 AM Mar 13, 2024, 6:12 AM

    I followed this guide provided by @JKnott in order to add IPv6 ULA addresses to all my devices, since the IPv6 GUA provided by my ISP changes from time to time:
    https://forum.netgate.com/topic/163161/using-unique-local-addresses

    In order to route traffic between my VLANs though, I had to create firewall rules that would allow traffic between these virtual ip subnets. Why is that though? Shouldn't those Virtual IPs, since they're assigned to an interface, be considered part of the interface net and included with my existing firewall rules?

    In digging more into this, I found this redmine bug:
    https://redmine.pfsense.org/issues/8386

    The description matches the issue I have and my thoughts, but Jim closed out the ticket saying the virtual IPs are included. Maybe that's on the WAN interface? Because I'm not seeing them on my VLAN interfaces, and in order to route traffice between my VLANs using their Virtual IP /64 ULA networks, I have to create new firewall rules.

    I end up duplicating most of my firewall rules which ends up getting messy:
    eea288c9-d094-4757-9475-66a45fe5e2a5-image.png

    T 1 Reply Last reply Apr 7, 2024, 9:57 PM Reply Quote 0
    • T
      Tzvia @OffstageRoller
      last edited by Apr 7, 2024, 9:57 PM

      @OffstageRoller I don't know if you found the patch since posting this... but in SYSTEM/PATCHES is a patch for the VIP networks not being part of the interface net, "IPV6 VIP Networks".

      Tzvia

      Current build:
      Hunsn/CWWK Pentium Gold 8505, 6x i226v 'micro firewall'
      16 gigs ram
      500gig WD Blue nvme
      Using modded BIOS (enabled CSTATES)
      PFSense 2.72-RELEASE
      Enabled Intel SpeedShift
      Snort
      PFBlockerNG
      LAN and 5 VLANS

      O 1 Reply Last reply Apr 10, 2024, 6:06 AM Reply Quote 0
      • O
        OffstageRoller @Tzvia
        last edited by Apr 10, 2024, 6:06 AM

        @Tzvia said in Why are Virtual IPs not considered part of their interface net for firewall rules?:

        @OffstageRoller I don't know if you found the patch since posting this... but in SYSTEM/PATCHES is a patch for the VIP networks not being part of the interface net, "IPV6 VIP Networks".

        Thank you for the reply @Tzvia

        I'm running the latest pfSense 23.09.1, and the latest System Patches version 2.2.9_1.

        In System Patches I only have 1 patch available for:

        • Workaround for Terrapin SSH Attack

        767486d5-fe2c-4f7f-a978-b54f609de9fe-image.png

        🀷

        B 1 Reply Last reply Apr 10, 2024, 8:44 AM Reply Quote 0
        • B
          Bob.Dig LAYER 8 @OffstageRoller
          last edited by Apr 10, 2024, 8:44 AM

          @OffstageRoller You have to add it manually. But it has side effects. Or maybe you shouldn't use Auto Apply, I can't say for sure.

          O 1 Reply Last reply Apr 11, 2024, 3:55 AM Reply Quote 0
          • O
            OffstageRoller @Bob.Dig
            last edited by Apr 11, 2024, 3:55 AM

            @Bob-Dig Thank you for referencing that. At least it's a known bug at this point. I originally thought this may have been a design decision to do things this way.

            S 1 Reply Last reply Apr 11, 2024, 4:19 AM Reply Quote 0
            • S
              SteveITS Galactic Empire @OffstageRoller
              last edited by SteveITS Apr 11, 2024, 4:19 AM Apr 11, 2024, 4:19 AM

              @OffstageRoller it’s in 24.03:
              https://docs.netgate.com/pfsense/en/latest/releases/24-03.html#aliases-tables

              Ref https://www.netgate.com/blog/netgate-releases-rc-of-pfsense-plus-software-version-24.03

              Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
              When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
              Upvote πŸ‘ helpful posts!

              O 1 Reply Last reply Apr 11, 2024, 6:44 AM Reply Quote 0
              • O
                OffstageRoller @SteveITS
                last edited by Apr 11, 2024, 6:44 AM

                @SteveITS Awesome news. That should hopefully be released in the next couple of weeks and then I can remove all these duplicated firewall rules I have in place! Thank you for linking me to that!

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                  This community forum collects and processes your personal information.
                  consent.not_received