Error loading rules after both WAN were down.Wrong firewall rule in debug.rules?

  • Hi,

    I am using Multi-WAN with two ADSL connections and double NAT on both connections. This morning we ha a power cycle test and both WAN went down. After both went up again pfsense threw out this error message:

    Jan 3 07:00:29 	php: : There were error(s) loading the rules: /tmp/rules.debug:132: syntax error pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [132]: pass in quick on $LAN $GWWAN2 from any to /8 keep state label "USER_RULE: Zugriff auf WAN2-Subnet"

    I checked rules.debug and found this entry - not on line 132 but on line 138:

    pass  in  quick  on $LAN  $GWWAN1  from any to keep state  label "USER_RULE: Zugriff auf WAN1-Subnet"

    As I said before I use Muli-WAN with double NAT and to reach the subnet before WAN1 I created a firewall rule. But my firewall rule is pointing to WAN1 SUBNET and not WAN1-Address like the debug rules show.

    In line 139 of debug.rules there is for me the correct firewall rule for WAN2-SUBNET:

    pass  in  quick  on $LAN  $GWWAN2  from any to keep state  label "USER_RULE: Zugriff auf WAN2-Subnet"

    I attached you a screenshot of my firewall rules on LAN so you can have a look at them.
    Further I attached all the syslog output and the "rules.debug" file.

    I had these problems several times in the past alway when there was the power cycle test but I didn't spent it much attention.

    I am using pfsense 2.0 release i386.
    Packages are:
    OpenVPN Export Utility

    "Sticky rules" is not checked
    "Allow default gateway switching" is not checked

    Thank you for your attention and hopfully for your help :-)
    ![Firewall LAN.jpg](/public/imported_attachments/1/Firewall LAN.jpg)
    ![Firewall LAN.jpg_thumb](/public/imported_attachments/1/Firewall LAN.jpg_thumb)


  • I deleted the firewall rule for WAN1 subnet and re-created the rule but with no success/change.

    Noone who could help me with this problem ? Or perhaps it is none ;)

Log in to reply