In preparation for a move from an IPv4 only setup to an IPv4 & IPv6 setup, from what I read, it appears it would be a good idea to change all my device aliases from being Host (IPv4 based) to MAC Id based.
The majority of my firewall rules use Aliases, so I'm thinking if I do this and switch the scope of those rules from IPv4 to IPv4+IPv6 then all those rules will apply nicely to both IPv4 and IPv6.
So to get this done, I have downloaded:
- the Alias's json extract, and
- the DNSMASQ DNS & DHCP - Host extract .csv file.
My plan, unless there is already a script out there (hence in part the reason for this post) is to write a script that will create a file I can import (upload) into the Aliases list which contains for all devices aliases a replacement entry that uses:
- an Alias Type of 'mac' instead of 'host' and
- in content replaces the existing IPv4 address(es) with their matching hw_address (mac) from the DNSMASQ DNS & DHCP - Host extract .csv file.
So my questions are:
1. Will this work?
2. Is there already an existing script for this?
Before scripting this, there are two things good to know:
MAC aliases only work for devices on networks directly connected to the firewall, because OPNsense resolves them from its ARP/NDP tables. With IPv6 privacy addresses, the address currently used can change, and the alias will only catch it once it appears in the NDP table. Phones using randomized MAC addresses can also be a problem here.
If your IPv6 prefix is static, I think the most predictable solution is simply to add the IPv6 host entries next to the IPv4 ones in the same alias.
If your ISP prefix can change, have a look at the "Dynamic IPv6 Host" alias type. It combines the current prefix of the interface with a fixed host part, so you don't have to change all aliases when the prefix changes.
For doing the bulk change: in Firewall > Aliases you can export/import the aliases as JSON. So normally you can edit the export (type and content of each alias) and import it back.
I would make a config backup before, and test it first with only one alias before doing all of them.