Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Negative match based on Alias of multiple networks?

    Scheduled Pinned Locked Moved 2.0-RC Snapshot Feedback and Problems - RETIRED
    2 Posts 2 Posters 1.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      stompro
      last edited by

      Can someone confirm that rule matching based on negative (not) aliases works?

      I have an alias of local network ranges.

      I'm trying to match traffic that has a src from that alias and destination not to that alias, to match traffic that will be routed to the Wan.

      Matching based on src = alias, dest = alias works just fine, but when I negate the dest != alias it doesn't seem to match the traffic that it should.

       <alias><name>ShaperLocalLAN</name>
      
      <address>192.168.227.0/24 192.168.1.0/24</address>
      
      			<type>network</type>
      			<detail></detail></alias> 
      
       <rule><id><type>match</type>
                              <tag><tagged><direction>out</direction>
                              <floating>yes</floating>
                              <max><max-src-nodes><max-src-conn><max-src-states><statetimeout><statetype>keep state</statetype>
      
                              <source>
      
      <address>ShaperLocalLAN</address>
      
                              <destination><address>ShaperLocalLAN</address></destination> 
                              <log><defaultqueue>qP2P</defaultqueue></log></statetimeout></max-src-states></max-src-conn></max-src-nodes></max></tagged></tag></id></rule> 
      
      table <shaperlocallan>{   192.168.227.0/24  192.168.1.0/24 }
      ShaperLocalLAN = "<shaperlocallan>"
      match  out log  from   $ShaperLocalLAN to  ! $ShaperLocalLAN  queue (qP2P)  label "USER_RULE: Shaper - All - Default To Wan P2P"</shaperlocallan></shaperlocallan> 
      

      Thanks
      Josh

      Hardware used: Alix 2D13 X 10, APU2D4 X 10, SG-2200 X 10, SG-2440 X 4

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        It should be working in the version of pf we have on 2.0. It certainly did not work for 1.2.x though.

        That said, using negation can usually be worked around by using two rules, a block and a pass, to achieve the same effect in a manner which is easier to read.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.