Boot error: … loading the rules: no IP address found for <dyn.dns.name>...</dyn.dns.name>



  • Hello,

    I have a few IPsec tunnels from pfsense 1.2.3 to Linksys WRVS4400N whose (opposite) endpoints are dynamic dns hosts, specified in the webconfigurator gui under VPN:IPsec:Edit Tunnel like this:

    Remote Gateway  'host1.dyndns.com'

    this is fine and the tunnel is fine, everything works.  But at reboot, when loading the /tmp/rules.debug it would hang for a looong time at (console output):

    Loading firewall ...
    

    the eventual logs that would return after twenty or thirty minutes were a bunch of entries like this:

    php: : New alert found: There were error(s) loading the rules: no IP address found for host1.dyndns.com /tmp/rules.debug:609: could not parse host specification no IP address found for host1.dyndns.com /tmp/rules.debug:610: could not parse host specification no IP address found for host1.dyndns.com /tmp/rules.debug:611: could not parse host specification no IP address found for host1.dyndns.com /tmp/rules.debug:612: could not parse host specification no IP address found for host1.dyndns.com
    php: : New alert found: There were error(s) loading the rules: no IP address found for host2.dyndns.com /tmp/rules.debug:613: could not parse host specification no IP address found for host2.dyndns.com /tmp/rules.debug:614: could not parse host specification no IP address found for host2.dyndns.com /tmp/rules.debug:615: could not parse host specification no IP address found for host2.dyndns.com /tmp/rules.debug:616: could not parse host specification no IP address found for host2.dyndns.com
    

    eventually i got it to fully boot by entering the remote ipsec hosts in /var/etc/hosts which seems to get copied verbatim to /etc/hosts sometime on boot.

    Obviously this is a silly hack since now these hosts are no longer dynamic and when their ip addresses change i will have to re-enter the new ip address into the hosts file.

    The problem seems to be that pfsense has no dns capability before loading /tmp/rules.debug, and in order to have dns capability it needs to load the firewall - chicken and egg problem?

    Is there a way around this that I haven't thought of?

    thanks for any help


Log in to reply