Firewall Aliases for IP addresses not working

[wotcha]

My Firewall rules with alias is not working.
This is what I am getting:

Code Select Expand


2023-07-06T15:15:03 Error firewall alias resolve error Group_30_IPs (error fetching alias url 10.0.30.53)
2023-07-06T15:15:03 Error firewall error fetching alias url 10.0.30.53
2023-07-06T13:04:30 Error firewall alias resolve error Group_20_IPs (error fetching alias url 10.0.20.51:55)
2023-07-06T13:04:30 Error firewall error fetching alias url 10.0.20.51:55


- VLAN 30 I am using DNSmasq,
- VLAN 20 I am using Unbound.
- Running Opnsense Version 23.1.11   


Otherwise I specifically have to type in every IP address as a "Single host" in the firewall rules for VLAN 30 for it to work. That's a lot of firewall rules...

[Patrick M. Hausen]

You created aliases of type URL, apparently. IP addresses need to be of type host.

[wotcha]

You created aliases of type URL, apparently. IP addresses need to be of type host.

Thanks, wow I can't believe I missed that. No wonder I've been having so much trouble. Calling the category "URL (IPs)" seems misleading. Perhaps "URL (IP Tables)" would be better.

[Patrick M. Hausen]

https://docs.opnsense.org/manual/aliases.html  ;)

[wotcha]

https://docs.opnsense.org/manual/aliases.html  ;)

I am now getting this error:

Code Select Expand


2023-07-06T15:56:00 Error firewall The DNS query name does not exist: 10.0.20.51:55. [for Group_20_IPHosts]
2023-07-06T15:50:33 Error firewall The DNS query name does not exist: 10.0.20.51:55. [for Group_20_IPHosts]
2023-07-06T15:45:28 Error firewall The DNS query name does not exist: 10.0.20.51:55. [for Group_20_IPHosts]


I thought I can express IP addresses as a range with a colon?

Nevermind I see it has to be written as "10.0.20.51-10.0.20.55"

[wotcha]

My alias is still not working..
I have this Firewall rule at the top...

with an Alias of:
- Name: Group_30_IPs
- Type: host
- Content: 10.0.30.50-10.0.30.55

Yet it is still being denied on that VLAN.

These are the screenshots of my firewall rules

[Mayo132]

Hi,

You are allowing only TCP traffic. 
> Have you tried it with the setting "ANY" ?

Mario