After upgrading to 26.7.1 none of the Aliases defined are working correctly in the Firewall rules eg
Internal_DNS_servers alias defined with multiple IPv4 and IPv6 addresses
Rule allows Internal_DNS_servers to make any DNS connection UDP/TCP
Later I have another rule which blocks non DNS servers from making external DNS queries
Rule blocks !Internal_DNS_servers to make any DNS connection UDP/TCP
My internal DNS servers are being blocked on the second rule
Tried upgrading to 26.7.1_1 no change in operation
I've seen this behavior as well:
https://forum.opnsense.org/index.php?topic=52494.msg271271#msg271271 (https://forum.opnsense.org/index.php?topic=52494.msg271271#msg271271)
Looking at the forum post below, there was a suggestion that removing the underscore might be a resolution, tried removing all the underscrore characters from my aliases and applied the update but the problem remained.
Upgraded to 26.7.2 this evening, disabled my allow all traffic rule and immediately the DNS servers DNS queries were being blocked.
The current single DNS_NTP_Server alias which consisted of each server IPv4 and IPv6 address was replaced.
Each DNS server had a host alias created consisting of its IPv4 and IPv6 address, then a DNS_Server host alias was created consisting of each DNS server host alias. Editted the existing firewall rules to replace the old DNS_Svr host alias with the new DNS_Server Host alias. Disabled my allow any rule, the DNS Server traffic was being blocked. Tried disabling the block !DNS_Server rule to see if the traffic would be allowed but it was still blocked, it is as though the DNS_Server all DNS traffic rule was being ignored.
Upgraded to 27.7.2_2 yesterday still problems with host aliases not working in firewall rules, also noted that my acme certificate update process has failed.
Correction the Acme Ceritificate issue was a problem with an upstream router which is now fixed.
Updated to 26.7.3_8 today, after reboot disabled the general allow all rule so all my rules with host aliases will be processed and all the DNS Servers traffic immediately started being blocked again. Had to re-enable my allow all rule.
Upgraded to 26.7.3_11 today and found that a Host alias in a rule which used Any protocol to Any destination did actually work.
However, a Host Alias in a rule with Protocol set to TCP/UDP and source the Host Aliases amd any destination but with a destination port of 53 (ie my DNS server rule) continues to be ignored so hits the default deny rule.
Did you hit apply in both the Alias page and the Rules page?
Question "Did you hit apply in both the Alias page and the Rules page?"
Response "Yes, after every time I created an Alias. Just in case I went back to the Aliases page pressed apply then disabled my allow all rule making sure I have pressed apply and like before the DNS Server port 53 traffic is being blocked then had to re-enabled my allow all rule."
I recreated the DNS Host Alias objects as the original HOST alias was not working.
What I have now tried:
1. Cloned DNS Server TCP/UDP access to rule anywhere where destination is Port 53 and disabled original rule
2. Changed cloned DNS Server rule still TCP/UDP access to anywhere but using any port .................................. rule still would not work
3. Changed cloned DNS Server rule so source changed from DNS Servers to dns, dns2, dns3 to anywhere using any port .... rule still would not work
Interestingly the NTP Server alias group with a UDP access to anywhere where destination port 123 does work.
DNS Server Host alias contains dns1, dns2, dns3
NTP Server Host alias contains dns1, dns2, dns3
Hi,
I found a workaround that has solved my problem and works after a reboot. After disabling my allow all rule. I cloned the NTP Server rule which worked for UDP traffic on port 123 and added the DNS Server alias and changed the traffic to UDP/TCP and port from 123 to 53, then moved it in front of the old DNS Server rule. After establishing the rule worked I removed the NTP Server host alias from the rule, applied changed, monitored traffic then rebooted, rule continued to work after reboot.
Just need to the check the !DNS Server rule blocking internal clients is working correctly.
Checked the !DNS Server rule and it is working correctly. Not sure what happened to the original DNS Server but it has been deleted as the new rule is working