Feature Request: Allow interface subnets as members of Network Aliases

gebra

Hi all,

I would like to suggest an enhancement to the pfSense WebGUI alias configuration.

Currently, firewall rules can directly use dynamic interface subnet objects such as:

LAN subnets
VLAN10 subnets
VLAN20 subnets
VLAN30 subnets

This works very well, especially with IPv6 Prefix Delegation, because pfSense dynamically maintains all networks assigned to an interface.

For example, a generated /tmp/rules.debug could contain entries similar to:

table <LAN__NETWORK> persist {
    192.0.2.0/26
    2001:db8:100:10::/64
    fd00:1234:5678:10::1/64
}

table <OPT1__NETWORK> persist {
    192.0.2.64/26
    2001:db8:100:20::/64
    fd00:1234:5678:20::1/64
}

table <OPT2__NETWORK> persist {
    192.0.2.128/26
    2001:db8:100:30::/64
    fd00:1234:5678:30::1/64
}

pfSense therefore already maintains the complete set of networks for each interface, including:

- static IPv4 networks
- static IPv6 ULA networks
- dynamic IPv6 GUA networks obtained through Prefix Delegation

The limitation appears when a firewall rule needs to match the networks of multiple interfaces.

For example, I would like to create an alias such as:

INTERNAL_NETWORKS

containing:

LAN subnets
VLAN10 subnets
VLAN20 subnets
VLAN30 subnets

and then use:

Source:      INTERNAL_NETWORKS
Destination: INTERNAL_NETWORKS

Currently this cannot be done through the alias configuration. The alias validator only accepts addresses, networks, FQDNs or existing aliases.

I also tested referencing the internally generated objects directly, e.g.:

$lan_network
$opt1__network
$opt2__network

but the WebGUI rejects them as invalid alias members.

The obvious workaround is to manually add all IPv4 and IPv6 networks to a normal Network Alias. However, this is problematic with IPv6 Prefix Delegation: the GUA prefixes are dynamic and can change, while the pfSense-generated interface subnet tables are automatically updated.

It would therefore be useful if Network Aliases could contain interface subnet objects as members.

Conceptually, the WebGUI could allow something like:

Alias: INTERNAL_NETWORKS

Members:
    LAN subnets
    VLAN10 subnets
    VLAN20 subnets
    VLAN30 subnets

The resulting alias should dynamically represent the union of the selected interface subnet objects.

This would avoid hardcoding delegated IPv6 prefixes and would make rules involving multiple internal interfaces considerably easier to maintain.

The required information already appears to exist in the generated PF configuration through the *_NETWORK tables. The requested feature would expose these existing dynamic interface network objects for composition in aliases.

Environment:

pfSense CE 2.9.0
IPv4 + IPv6
IPv6 Prefix Delegation / Track Interface
Static ULA prefixes

Would this be feasible as an extension of the Network Alias WebGUI?

Many thanks to all commitments and volonteers working on this!

Best regard,
gebra

Bob.Dig

@gebra There is a workaround, if you are interested. Create an Interface Group, add all the interfaces of interest. And with that you now have that Group-Alias to work with, you don't need to create any firewall rules on that Interface Group.

gebra

@Bob.Dig I'll give that a try. Thank you!

gebra

@Bob.Dig - Really Thanks! That actually works perfectly.

I tested it on pfSense CE 2.9.0 with an Interface Group containing five interfaces.

pfSense created the corresponding TEST_INTERNAL__NETWORK table automatically, and pfctl confirms that it contains all networks of the member interfaces, including IPv4, ULA and the dynamically delegated GUA prefixes.

So functionally, this solves exactly what I was looking for. Thank you for pointing this out!

There is only one downside when using Interface Groups purely for this purpose:

Every Interface Group also creates an additional tab under Firewall > Rules.

For one group this is obviously not a problem, but if you need four or five different logical groups as dynamic network aliases, the Rules page ends up with four or five additional tabs which don't contain any rules and are only there because the Interface Groups are being used as network objects.

That's why I still think allowing Interface subnets as members of a regular Network Alias could be a useful WebGUI enhancement. It would provide the same functionality without adding unused Interface Group tabs to the Rules page.

But as a workaround, the Interface Group solution definitely works — and it also handles dynamic IPv6 Prefix Delegation exactly as needed.

Thanks again!