OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Archive »
  • 18.1 Legacy Series »
  • Aliases dosen't work(?)
« previous next »
  • Print
Pages: 1 2 3 [4]

Author Topic: Aliases dosen't work(?)  (Read 16514 times)

marjohn56

  • Hero Member
  • *****
  • Posts: 1677
  • Karma: 171
    • View Profile
Re: Aliases dosen't work(?)
« Reply #45 on: January 18, 2018, 05:15:57 pm »
Well I've just had a severe hour or two, going round in ever decreasing circles...

I had trouble with getting my system to work everytime I pulled in the config from 17.7.11, running a ping against google failed after every reboot. The only way to get it back was to disable all the rules except the default ones, apply it and back would come the ping, re-apply, all works.... reboot, lost pings again. :(

looked at rules debug, ahah... the gateway is different on a reboot... it was, it jumps between different gateways on boot, but that was not the issue...

No, it was the rules, namely the IPV6 ICMP rule, which now needs to be IPv6 ICMP.v6

I'm going for a pint.... or several!
Logged
OPNsense 21.7 - Qotom Q355G4 - ISP - Community Fibre 1Gbps.

Team Rebellion Member - If we've helped you remember to applaud

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13957
  • Karma: 1210
    • View Profile
Re: Aliases dosen't work(?)
« Reply #46 on: January 18, 2018, 05:58:39 pm »
This doesn't sound so good, something in the code to fix or add compat for in the rules generation?


Cheers,
Franco
Logged

nivek1612

  • Full Member
  • ***
  • Posts: 188
  • Karma: 25
    • View Profile
Re: Aliases dosen't work(?)
« Reply #47 on: January 18, 2018, 07:03:44 pm »
I see you snuck out 17.7.12 when I was testing 18.1r2

thought my eyes where going for a minute when I looked in the System:Firmware 
Logged
OPNsense 23.1.* on Qotom i5-5250U with Zen FTTC 80/20
OPNsense 23.1.* on Qotom i7-4500U with Orange FR FTTP 1000/400 and SFR FTTP 200/20

Team Rebellion Member
One of Marjohns TESTERS :-)

marjohn56

  • Hero Member
  • *****
  • Posts: 1677
  • Karma: 171
    • View Profile
Re: Aliases dosen't work(?)
« Reply #48 on: January 18, 2018, 07:42:56 pm »
Quote from: franco on January 18, 2018, 05:58:39 pm
This doesn't sound so good, something in the code to fix or add compat for in the rules generation?


Cheers,
Franco

If you make  it compatible the you dont need the option in the drop down list, it is a bit misleading, you. Select ipv6 then ICMP,  that's what gets you, you type Ic and up comes ICMP, and it is, but for v4. I wonder how many that will catch.  ;)
Logged
OPNsense 21.7 - Qotom Q355G4 - ISP - Community Fibre 1Gbps.

Team Rebellion Member - If we've helped you remember to applaud

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13957
  • Karma: 1210
    • View Profile
Re: Aliases dosen't work(?)
« Reply #49 on: January 18, 2018, 07:53:42 pm »
@nivek1612: keeping the 17.7.x folk happy hopefully. :)

@marjohn56: Ah so a user-config error? It's true that ICMP and ICMP6 are different IANA numbers. I thought it was something transcending the worlds between 17.7 and 18.1 causing an incompatibility. Discussing ways forward, the ICMP could be appended with 4 or v4 to make it more clear and cleanly sidestep the issue of ambiguity?
Logged

marjohn56

  • Hero Member
  • *****
  • Posts: 1677
  • Karma: 171
    • View Profile
Re: Aliases dosen't work(?)
« Reply #50 on: January 18, 2018, 07:56:33 pm »
Or just select ICMP and let the backend work out which, v4 or V6 has already been selected or the drop down list should be empty. Failing that, start both labels with ICMP and add V6 v4 to the end of the label. At present if you enter 'Ic' you only get ICMP for v4.
« Last Edit: January 18, 2018, 08:08:44 pm by marjohn56 »
Logged
OPNsense 21.7 - Qotom Q355G4 - ISP - Community Fibre 1Gbps.

Team Rebellion Member - If we've helped you remember to applaud

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13957
  • Karma: 1210
    • View Profile
Re: Aliases dosen't work(?)
« Reply #51 on: January 19, 2018, 09:44:05 am »
Enter the guy who reported this and said he would have a CVE assigned:

https://github.com/opnsense/core/commit/ae677059d

The story behind it was that although pf accepts these values, it cannot filter them. The CVE was never assigned in the end, though.

Moral of the story: don't try to outsmart 99% of the users for their own benefit, the 1% will try assign a CVE for when a security-related option does not do what it says it should. Since we can't be sure, we should simply make the choices less ambiguous.


Cheers,
Franco
Logged

cardins2u

  • Jr. Member
  • **
  • Posts: 70
  • Karma: 2
    • View Profile
Re: Aliases dosen't work(?)
« Reply #52 on: January 20, 2018, 02:20:17 am »
After running the two patch my alias still doesn't work.



root@OPNsense:~ # df
Filesystem      1K-blocks    Used    Avail Capacity  Mounted on
/dev/gpt/rootfs  92421240 4125852 80901692     5%    /
devfs                   1       1        0   100%    /dev
devfs                   1       1        0   100%    /var/dhcpd/dev
root@OPNsense:~ #
Logged

marjohn56

  • Hero Member
  • *****
  • Posts: 1677
  • Karma: 171
    • View Profile
Re: Aliases dosen't work(?)
« Reply #53 on: January 20, 2018, 08:38:48 am »
Was this with a clean install of 18.1.rc1?
Logged
OPNsense 21.7 - Qotom Q355G4 - ISP - Community Fibre 1Gbps.

Team Rebellion Member - If we've helped you remember to applaud

cardins2u

  • Jr. Member
  • **
  • Posts: 70
  • Karma: 2
    • View Profile
Re: Aliases dosen't work(?)
« Reply #54 on: January 20, 2018, 12:38:02 pm »
yes - clean install and restored configurations.
Logged

marjohn56

  • Hero Member
  • *****
  • Posts: 1677
  • Karma: 171
    • View Profile
Re: Aliases dosen't work(?)
« Reply #55 on: January 20, 2018, 01:28:13 pm »
are the aliases showing in rules.debug?
Logged
OPNsense 21.7 - Qotom Q355G4 - ISP - Community Fibre 1Gbps.

Team Rebellion Member - If we've helped you remember to applaud

marjohn56

  • Hero Member
  • *****
  • Posts: 1677
  • Karma: 171
    • View Profile
Re: Aliases dosen't work(?)
« Reply #56 on: January 20, 2018, 01:45:48 pm »
Quote from: cardins2u on January 20, 2018, 12:38:02 pm
yes - clean install and restored configurations.

Did you do just the two patches mentioned here or three patches? There is one more that MIGHT affect you.

653651046fda533983bfc818d087fee5f073c7f6

That was one to make sure the aliastables folder is there and behaving.
Logged
OPNsense 21.7 - Qotom Q355G4 - ISP - Community Fibre 1Gbps.

Team Rebellion Member - If we've helped you remember to applaud

  • Print
Pages: 1 2 3 [4]
« previous next »
  • OPNsense Forum »
  • Archive »
  • 18.1 Legacy Series »
  • Aliases dosen't work(?)
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2