Aliases to support "No XMLRPC Sync" flag!

[chandrayandeepak]

In scenario like configuration sync between DC and DR, it would help if "No XMLRPC Sync" flag (likewise in Virtual IPs) is provided in "Aliases" also to explicitly instructed OPNsense to exclude it from replication.

There are policies to replicate from DC to DR where common alias name are used pointing to different content and DC -> DR sync would break required configuration at DR side.

An example maybe where Source NAT is used to let LAN side traffic go out of Alias named "AddOn_IP". For DC & DR, content of AddOn_IP may be different policy should stay same.

[BoNetTech]

Hi,

As far as I know there is no per-alias "No XMLRPC Sync" flag today. The "No XMLRPC Sync" option exists on some items (like Virtual IPs), but aliases are synced as one whole section.

A workaround that may fit your DC/DR case:

1. On the master, go to System > High Availability > Settings and untick "Aliases" in the list of items to sync.
2. Create the same alias names on both nodes, with different content on each (for example AddOn_IP).
3. Keep syncing the firewall rules and NAT as before. They only refer to the alias name, so they work on both nodes with the content of each node.

The price is that you must maintain all aliases by hand on both nodes. If you only need a few aliases to differ, you could keep these as local aliases and give them a clear name, so nobody forgets they are not synced.

I have not tested this on the latest version, so please try it first on a test pair. Since this is really a feature request (a per-alias flag), it may also be worth opening an issue on the OPNsense core GitHub repository, where the developers will see it.

Sergio