Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multiple alias in fw rule

    Scheduled Pinned Locked Moved webGUI
    7 Posts 3 Posters 3.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fireix
      last edited by

      Hi.

      Is there any way to allow multiple IPs (alias) in one fw rule? I'm about to switch to pfSense after using a commercial fw for years and have purchased a hardware unit. But I was disappointed when I found out I can't have multiple IPs/alias on each fw-rule. At least I have not found a way to do this (having an alias with ip-range doesn't help as the IPs is not in a spesific order). And I can only list one alias on target-host on each fw rule.

      Why would I want this? Because we have many webservers with same setup. Those I want in one rule. And the same servers can have email as well, those are in another group with a email-port-alias.

      Now I have to configure 100 rules to do the same web-ports and it will become very messy. If I want to change something on the web-rules (for instance turn on/off logging), I have to do the same clicking 100 times. And another 100 rules (or whatever number) for email etc.

      1 Reply Last reply Reply Quote 0
      • D
        dneuhaeuser
        last edited by

        you can easily define an alias with multiple hosts or networks.
        just use the "+" button to add more…

        1 Reply Last reply Reply Quote 0
        • F
          fireix
          last edited by

          I see that you can add a description beside each IP and that helps. It does however force you to make a lot of lists/groups. If you have just a few exception to a rule in the firewall (for some hosts in that alias-group), you must create a totally new alias group and type the clients name (alias for that IP) again many times. So it creates extra work to maintain when you have many IPs/hosts and increases the chances of doing errors and forgetting to update them all.

          This would be solved by having the same + for each destination row in the fw rules (that's how the commercial fws that I'm used to do it).

          1 Reply Last reply Reply Quote 0
          • H
            heper
            last edited by

            perhaps you could use nested aliases. (an alias inside an alias)

            1 Reply Last reply Reply Quote 0
            • F
              fireix
              last edited by

              That would help a lot. But is that possible in the interface? Im using v2.3. I don't see any documentation on how to do that.

              1 Reply Last reply Reply Quote 0
              • D
                dneuhaeuser
                last edited by

                yes, you should be able to add multiple aliases inside another alias.
                just type the alias names in the IP field.
                (use 1 row per alias entry, add with +)

                you will also see that the name will be autocompleted while typing…
                you can click on that to accept it.

                1 Reply Last reply Reply Quote 0
                • F
                  fireix
                  last edited by

                  I see that it kind of works, but it still creates a lot of double typing. When you create alias of any type, you hide the original value - like IP in my case (but same goes for ports!). So if you see a log entry of a certain IP and wonder where/what host it is, you can't just hoover over the alias-group to quickly isolate/find the host. Alias is often a good way to help find Host Alias->IP, but the interface ignores the other way, IP->Host alias.

                  The hoover should contain the alias value as well, like IP, port or whatever the original value is. A work-around is to enter the IP in the alias, but this creates a possible difference in real value vs textual description and a lot of extra work/confusion.

                  Hope this is fixed in later versions.

                  Another usefull feature developers could implement, is the number of referenced IP, hosts etc. in the fw rules, from Aliases. This is how Fortigate does it (if an alias is used three times, it has a link with number 3 that leads to fw-rules).

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.