26.7.1_1 - Alias not working - fixed

Started by inetjnky, Today at 12:08:53 AM

Previous topic - Next topic
Print
Go Down Pages1
User actions
Today at 12:08:53 AM
I haven't tested existing aliases, only a new Alias I created to block all internet traffic from the IPs of the LG OLED TVs.

Alias Created and enabled.  Name LG_TVs, Type:  Host(s), Content:  192.168.107.6, 192.168.107.7

Applied, powered off TVs killed all Firewall - Diagnostics - States for both IPs.  Powered TVs back on and verified I am able to access internet.

Used Claude to assist with troubleshooting.

SSH into Opensense box:

jason@opnsense:~ $ sudo pfctl -sr | grep -n "107.6\|107.7\|LG_TVs"
Password:
242:block drop in quick on vlan02 inet from <LG_TVs> to ! <PrivateNetworks> label "c61d8481-5bf4-4f08-b9eb-bd616fbae7e5"
243:block drop in quick on vlan02 inet6 from <LG_TVs> to ! <PrivateNetworks> label "c61d8481-5bf4-4f08-b9eb-bd616fbae7e5"

The rule is loaded in the live kernel ruleset, correctly as block drop in quick ... from <LG_TVs> to ! <PrivateNetworks> on vlan02. So it's not a stale-apply issue after all — the block rule genuinely exists in pf, in quick form, exactly as configured.

But it's at line 242/243 — quite far down in the ruleset. The states showed traffic matching "Allow access only to Internet" instead. Since pf evaluates top-to-bottom and stops at first quick match, that means the "Allow access only to Internet" rule for IOT network must be sitting at a lower line number (earlier in the ruleset) than 242, even though the OPNsense GUI displays it visually beneath the block rule on the interface tab.

jason@opnsense:~ $ sudo pfctl -sr | grep -n "Allow access only to Internet\|IOT network"
jason@opnsense:~ $ sudo pfctl -sr | grep -n "vlan02.*inet.*IOT network\|quick on vlan02"
109:pass in log quick on vlan02 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "03b1df4bf62ce677123044d57e8e60b7"
110:pass in log quick on vlan02 proto udp from any port = bootpc to (self) port = bootps keep state label "4749c8cd166b293d17735bbe5fafeba7"
111:pass out log quick on vlan02 proto udp from (self) port = bootps to any port = bootpc keep state label "4fa69e1fc6f690d3cf45e05e517f2448"
112:pass in log quick on vlan02 inet6 proto udp from fe80::/10 to fe80::/10 port = dhcpv6-client keep state label "939d681febd9e3466ef8a12b27d64c0f"
113:pass in log quick on vlan02 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-client keep state label "939d681febd9e3466ef8a12b27d64c0f"
114:pass in log quick on vlan02 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-server keep state label "4821d7ce2e22b7f16097ae6dc6d1daa2"
115:pass in log quick on vlan02 inet6 proto udp from ff02::/16 to fe80::/10 port = dhcpv6-server keep state label "c63c997e3cc96fd90d29d8b05686b19f"
116:pass in log quick on vlan02 inet6 proto udp from fe80::/10 to (self) port = dhcpv6-client keep state label "14c2a36dc5849b4ff7d2f27d17569718"
117:pass out log quick on vlan02 inet6 proto udp from (self) port = dhcpv6-server to fe80::/10 keep state label "a3228c8a3726d15188b7ff67041c14cd"
207:block drop in log quick on vlan02 inet6 from any to <crowdsec_blacklists> label "a3589517-dc02-4853-9298-18a02cc8bf61"
214:block drop in log quick on vlan02 inet from any to <crowdsec_blacklists> label "1c0d57bf-c8ee-4e67-be93-331a33069059"
236:pass in quick on vlan02 inet proto tcp from (vlan02:network) to (vlan02) port = domain flags S/SA keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
237:pass in quick on vlan02 inet proto udp from (vlan02:network) to (vlan02) port = domain keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
238:pass in quick on vlan02 inet6 proto tcp from (vlan02:network) to (vlan02) port = domain flags S/SA keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
239:pass in quick on vlan02 inet6 proto tcp from fe80::/10 to (vlan02) port = domain flags S/SA keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
240:pass in quick on vlan02 inet6 proto udp from (vlan02:network) to (vlan02) port = domain keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
241:pass in quick on vlan02 inet6 proto udp from fe80::/10 to (vlan02) port = domain keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
242:block drop in quick on vlan02 inet from <LG_TVs> to ! <PrivateNetworks> label "c61d8481-5bf4-4f08-b9eb-bd616fbae7e5"
243:block drop in quick on vlan02 inet6 from <LG_TVs> to ! <PrivateNetworks> label "c61d8481-5bf4-4f08-b9eb-bd616fbae7e5"
244:pass in quick on vlan02 inet proto tcp from (vlan02:network) to <IPCAM_MGMT> flags S/SA keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
245:pass in quick on vlan02 inet proto udp from (vlan02:network) to <IPCAM_MGMT> keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
246:pass in quick on vlan02 inet6 proto tcp from (vlan02:network) to <IPCAM_MGMT> flags S/SA keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
247:pass in quick on vlan02 inet6 proto tcp from fe80::/10 to <IPCAM_MGMT> flags S/SA keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
248:pass in quick on vlan02 inet6 proto udp from (vlan02:network) to <IPCAM_MGMT> keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
249:pass in quick on vlan02 inet6 proto udp from fe80::/10 to <IPCAM_MGMT> keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
298:pass in quick on vlan02 inet from (vlan02:network) to <NAS_STORAGE> flags S/SA keep state label "3509ce2e-28ea-451a-b149-e96b89d087e5"
299:pass in quick on vlan02 inet6 from (vlan02:network) to <NAS_STORAGE> flags S/SA keep state label "3509ce2e-28ea-451a-b149-e96b89d087e5"
300:pass in quick on vlan02 inet6 from fe80::/10 to <NAS_STORAGE> flags S/SA keep state label "3509ce2e-28ea-451a-b149-e96b89d087e5"
301:pass in quick on vlan02 inet from (vlan02:network) to <ProxmoxVMCTNetwork> flags S/SA keep state label "de0c65c6-e86f-43e4-a6a9-ec5246ca85da"
302:pass in quick on vlan02 inet6 from (vlan02:network) to <ProxmoxVMCTNetwork> flags S/SA keep state label "de0c65c6-e86f-43e4-a6a9-ec5246ca85da"
303:pass in quick on vlan02 inet6 from fe80::/10 to <ProxmoxVMCTNetwork> flags S/SA keep state label "de0c65c6-e86f-43e4-a6a9-ec5246ca85da"
383:pass in quick on vlan02 inet from (vlan02:network) to 192.168.108.20 flags S/SA keep state label "83ff2c9e-0951-43e5-a083-2e33e7ec071c"
384:pass in quick on vlan02 inet from 192.168.107.24 to (vlan01:network) flags S/SA keep state label "58847e5e-f396-4b5a-964a-7d41334101a2"
385:pass in quick on vlan02 inet from (vlan02:network) to ! <PrivateNetworks> flags S/SA keep state label "65d5bb0a-954a-495d-ae36-bb2423f804bf"
386:pass in quick on vlan02 inet6 from (vlan02:network) to ! <PrivateNetworks> flags S/SA keep state label "65d5bb0a-954a-495d-ae36-bb2423f804bf"
387:pass in quick on vlan02 inet6 from fe80::/10 to ! <PrivateNetworks> flags S/SA keep state label "65d5bb0a-954a-495d-ae36-bb2423f804bf"
jason@opnsense:~ $ sudo pfctl -sr | grep -n "vlan02"
3:block drop in log on vlan02 inet6 from fe80::aab8:e0ff:fe02:43b to any
12:block drop in log on ! vlan02 inet6 from ::/64 to any
21:block drop in log on ! vlan02 inet from 192.168.107.0/24 to any
109:pass in log quick on vlan02 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "03b1df4bf62ce677123044d57e8e60b7"
110:pass in log quick on vlan02 proto udp from any port = bootpc to (self) port = bootps keep state label "4749c8cd166b293d17735bbe5fafeba7"
111:pass out log quick on vlan02 proto udp from (self) port = bootps to any port = bootpc keep state label "4fa69e1fc6f690d3cf45e05e517f2448"
112:pass in log quick on vlan02 inet6 proto udp from fe80::/10 to fe80::/10 port = dhcpv6-client keep state label "939d681febd9e3466ef8a12b27d64c0f"
113:pass in log quick on vlan02 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-client keep state label "939d681febd9e3466ef8a12b27d64c0f"
114:pass in log quick on vlan02 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-server keep state label "4821d7ce2e22b7f16097ae6dc6d1daa2"
115:pass in log quick on vlan02 inet6 proto udp from ff02::/16 to fe80::/10 port = dhcpv6-server keep state label "c63c997e3cc96fd90d29d8b05686b19f"
116:pass in log quick on vlan02 inet6 proto udp from fe80::/10 to (self) port = dhcpv6-client keep state label "14c2a36dc5849b4ff7d2f27d17569718"
117:pass out log quick on vlan02 inet6 proto udp from (self) port = dhcpv6-server to fe80::/10 keep state label "a3228c8a3726d15188b7ff67041c14cd"
207:block drop in log quick on vlan02 inet6 from any to <crowdsec_blacklists> label "a3589517-dc02-4853-9298-18a02cc8bf61"
214:block drop in log quick on vlan02 inet from any to <crowdsec_blacklists> label "1c0d57bf-c8ee-4e67-be93-331a33069059"
236:pass in quick on vlan02 inet proto tcp from (vlan02:network) to (vlan02) port = domain flags S/SA keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
237:pass in quick on vlan02 inet proto udp from (vlan02:network) to (vlan02) port = domain keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
238:pass in quick on vlan02 inet6 proto tcp from (vlan02:network) to (vlan02) port = domain flags S/SA keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
239:pass in quick on vlan02 inet6 proto tcp from fe80::/10 to (vlan02) port = domain flags S/SA keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
240:pass in quick on vlan02 inet6 proto udp from (vlan02:network) to (vlan02) port = domain keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
241:pass in quick on vlan02 inet6 proto udp from fe80::/10 to (vlan02) port = domain keep state label "bac5a17f-a0f6-4b76-ac06-2fc6db7f797b"
242:block drop in quick on vlan02 inet from <LG_TVs> to ! <PrivateNetworks> label "c61d8481-5bf4-4f08-b9eb-bd616fbae7e5"
243:block drop in quick on vlan02 inet6 from <LG_TVs> to ! <PrivateNetworks> label "c61d8481-5bf4-4f08-b9eb-bd616fbae7e5"
244:pass in quick on vlan02 inet proto tcp from (vlan02:network) to <IPCAM_MGMT> flags S/SA keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
245:pass in quick on vlan02 inet proto udp from (vlan02:network) to <IPCAM_MGMT> keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
246:pass in quick on vlan02 inet6 proto tcp from (vlan02:network) to <IPCAM_MGMT> flags S/SA keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
247:pass in quick on vlan02 inet6 proto tcp from fe80::/10 to <IPCAM_MGMT> flags S/SA keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
248:pass in quick on vlan02 inet6 proto udp from (vlan02:network) to <IPCAM_MGMT> keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
249:pass in quick on vlan02 inet6 proto udp from fe80::/10 to <IPCAM_MGMT> keep state label "e909a6be-6b1e-49f8-b05c-12f7d5830140"
284:pass in quick on vlan01 inet from <NAS_STORAGE> to (vlan02) flags S/SA keep state label "7bf91b41-e226-43b4-89bc-c3bd35de1186"
285:pass in quick on vlan01 inet6 from <NAS_STORAGE> to (vlan02) flags S/SA keep state label "7bf91b41-e226-43b4-89bc-c3bd35de1186"
298:pass in quick on vlan02 inet from (vlan02:network) to <NAS_STORAGE> flags S/SA keep state label "3509ce2e-28ea-451a-b149-e96b89d087e5"
299:pass in quick on vlan02 inet6 from (vlan02:network) to <NAS_STORAGE> flags S/SA keep state label "3509ce2e-28ea-451a-b149-e96b89d087e5"
300:pass in quick on vlan02 inet6 from fe80::/10 to <NAS_STORAGE> flags S/SA keep state label "3509ce2e-28ea-451a-b149-e96b89d087e5"
301:pass in quick on vlan02 inet from (vlan02:network) to <ProxmoxVMCTNetwork> flags S/SA keep state label "de0c65c6-e86f-43e4-a6a9-ec5246ca85da"
302:pass in quick on vlan02 inet6 from (vlan02:network) to <ProxmoxVMCTNetwork> flags S/SA keep state label "de0c65c6-e86f-43e4-a6a9-ec5246ca85da"
303:pass in quick on vlan02 inet6 from fe80::/10 to <ProxmoxVMCTNetwork> flags S/SA keep state label "de0c65c6-e86f-43e4-a6a9-ec5246ca85da"
354:pass in quick on vlan07 inet from <ProxmoxVMCTNetwork> to (vlan02) flags S/SA keep state label "5116012b-f854-4419-a6c1-0c32e9e09a01"
355:pass in quick on vlan07 inet6 from <ProxmoxVMCTNetwork> to (vlan02) flags S/SA keep state label "5116012b-f854-4419-a6c1-0c32e9e09a01"
383:pass in quick on vlan02 inet from (vlan02:network) to 192.168.108.20 flags S/SA keep state label "83ff2c9e-0951-43e5-a083-2e33e7ec071c"
384:pass in quick on vlan02 inet from 192.168.107.24 to (vlan01:network) flags S/SA keep state label "58847e5e-f396-4b5a-964a-7d41334101a2"
385:pass in quick on vlan02 inet from (vlan02:network) to ! <PrivateNetworks> flags S/SA keep state label "65d5bb0a-954a-495d-ae36-bb2423f804bf"
386:pass in quick on vlan02 inet6 from (vlan02:network) to ! <PrivateNetworks> flags S/SA keep state label "65d5bb0a-954a-495d-ae36-bb2423f804bf"
387:pass in quick on vlan02 inet6 from fe80::/10 to ! <PrivateNetworks> flags S/SA keep state label "65d5bb0a-954a-495d-ae36-bb2423f804bf"

The Block LG_TVs rule sits at line 242/243 — well before the general Allow access only to Internet rule at line 385/386, for both IPv4 and IPv6. Since pf is quick and evaluates top-down, any traffic sourced from LG_TVs will now hit the block at line 242 and stop right there — it will never reach line 385.

jason@opnsense:~ $ sudo pfctl -t LG_TVs -T show

The LG_TVs table is completely empty in the live kernel, despite the rule referencing it being loaded correctly at line 242/243. This is exactly why traffic sails right past the block rule (an empty table matches nothing) and falls through to the general allow rule further down. This is the actual root cause.  The fix,force a manual table load first, to test.

jason@opnsense:~ $ sudo pfctl -t LG_TVs -T add 192.168.107.6
1/1 addresses added.
jason@opnsense:~ $    sudo pfctl -t LG_TVs -T add 192.168.107.7
   sudo pfctl -t LG_TVs -T show1/1 addresses added.
jason@opnsense:~ $ sudo pfctl -t LG_TVs -T show
   192.168.107.6
   192.168.107.7

This should now show both IPs. If it does, kill the states again and test the TVs immediately — if they get blocked now, we've fully confirmed the table-sync issue is the culprit (though this manual add won't survive a reboot/reload, so it's just for confirmation, not the permanent fix).  The next command forces OPNsense to fully regenerate and reload the entire pf ruleset and all alias tables from the current config, which should definitely repopulate LG_TVs. Then check the table again.

jason@opnsense:~ $ sudo /usr/local/etc/rc.filter_configure
Configuring firewall.......done.
jason@opnsense:~ $ sudo pfctl -t LG_TVs -T show
   192.168.107.6
   192.168.107.7
jason@opnsense:~ $

Both IPs are now in the table. This confirms the theory completely: the table syncing from the alias definition to the running pf table was broken, and manually adding them fixed the immediate symptom.
Print
Go Up Pages1
User actions