25.7.3_3 - Filtering by source ip on a wireguard interface doesn't work

[rarcel]

Hi,

I have a strange issue since the upgrade to 25.7.3_3.

On a wireguard interface, an existing rule with an alias in the source address field doesn't work anymore. If I put "Any" instead of the alias, the rule works again (even if it's not what I want ^^ ).

Do I miss a breaking change ?

[franco]

Hi,

If you had 25.7.3 and grabbed 25.7.3 did you also hit "apply" under firewall: aliases?

And which alias type would that be exactly that doesn't work?


Cheers,
Franco

[rarcel]

 Hi,

I just did it, and unfortunately, it still doesn't work.

Aliases types are all "Hosts" in my case.

[Patrick M. Hausen]

And a packet trace or firewall log shows that the packets in question really match the source address in the alias?

[rarcel]

Yes it matches the alias, sorry I should mention it

[rarcel]

Here is the content of the capture (nc -v 192.168.1.8 22 from 192.168.21.4 ) :

length 64: (tos 0x0, ttl 64, id 19606, offset 0, flags [DF], proto TCP (6), length 60)
    192.168.21.4.60366 > 192.168.1.8.22: Flags , cksum 0x5721 (correct), seq 840528611, win 65424, options [mss 1392,sackOK,TS val 3660705569 ecr 0,nop,wscale 7], length 0

[Patrick M. Hausen]

Ok, then please show the rule definition.

[rarcel]

I think I see why it doesn't work, in Diagnotistics/ Aliases, the alias I try to use is empty, whatever I do (I tried to change the content, Hit the apply button), the table is still empty

[Patrick M. Hausen]

Then show the alias definition in the UI.

[rarcel]

I don't know if it's a coincidence, but it seems that all my aliases that contains two underscore in the name are empty. Others seems to be fine.

[rarcel]

Finally it seems to be random ( I have more than 100 aliases )

[franco]

> don't know if it's a coincidence, but it seems that all my aliases that contains two underscore in the name are empty.

This is odd, because 25.7.3_3 fixes exactly this.


Cheers,
Franco

[rarcel]

Searching in the logs, I found this :

[ba512d3a-0fe9-4e3b-8872-24a007932bed] Script action failed with Command '/usr/local/bin/flock -n -E 0 -o /tmp/filter_update_tables.lock /usr/local/opnsense/scripts/filter/update_tables.py ' returned non-zero exit status 1. at Traceback (most recent call last): File "/usr/local/opnsense/service/modules/actions/script_output.py", line 78, in execute subprocess.run(script_command, env=self.config_environment, shell=True, File "/usr/local/lib/python3.11/subprocess.py", line 571, in run raise CalledProcessError(retcode, process.args, subprocess.CalledProcessError: Command '/usr/local/bin/flock -n -E 0 -o /tmp/filter_update_tables.lock /usr/local/opnsense/scripts/filter/update_tables.py ' returned non-zero exit status 1.

[franco]

Ok, what happens when you manually run "/usr/local/opnsense/scripts/filter/update_tables.py" then?

[rarcel]

this appens: