pfSense bugtracker: Issueshttps://redmine.pfsense.org/https://redmine.pfsense.org/favicon.ico?16780521162024-02-21T03:59:00ZpfSense bugtracker
Redmine pfSense - Todo #15277 (New): Allow mixed source (URL (IPs), URL Table (IPs), Host(s) and Network(...https://redmine.pfsense.org/issues/152772024-02-21T03:59:00ZSergei Shablovsky
<p>Dear Brilliant pfSense DevTeam!</p>
<p>WHERE<br />in Firewall / Aliases</p>
<p>ARGUMENT <br />From firewall and user perspective there are two possible aliases:<br />- aliases for ports;<br />- aliases for IPs;<br />and pfSense make ability to entering both MANUALLY or AUTOMATICALLY by parsing the source (in PLAIN TXT, XML, JSON) himself.<br />And pfSense have WebGUI for entering this both.</p>
<p>From user perspective THE ALIASES ARE LOGICAL OBJECT TO GROUPING the IPs and ports.</p>
<p>FROM USER PERSPECTIVE would be useful mixed source of one type (for example URL (IPs), URL Table (IPs), Host(s) and Network(s) IN ONE ALIAS. <br />The same for Port(s), URL Port(s) and URL Table (Ports) - also IN ONE ALIAS.</p>
<p>EXAMPLE<br />Most external monitoring SaaS and servers/appliances manufacturers provide their services in a mixed form: FQDN + fixed IPs + fixed ports. <br />And if for ports LOGICALLY RIGHT to aggregate ports numbers in ONE ALIAS (for example StatusCake_PORT_MONITORING), for URLs would be also LOGICALLY RIGHT to aggregate IPs into ONE ALIAS (for example StatusCake_IP_MONITORING).</p>
<p>Page with example <a class="external" href="https://www.statuscake.com/kb/knowledge-base/what-are-your-ips/">https://www.statuscake.com/kb/knowledge-base/what-are-your-ips/</a></p>
<p>Otherwise pfSense user need to create 3(three!!!) separate aliases (URL (IPs), URL Table (IPs), Host(s)) for one service and after make + ANOTHER ONE alias for aggregating all 3(three) sources into one to using in pfSense firewall rules…<br />This significantly increase ability to mistyping/errors in process of rules configurations.</p>
<p>Thank You so much!</p> pfSense - Bug #15134 (Incomplete): Post upgrade to 2.7.2 - Change in alias name stops all traffichttps://redmine.pfsense.org/issues/151342024-01-03T11:03:01ZRajko Bogdanovicrajko@itroom-a.com
<p>After installing the last 2.7.2 release, when we edited an Alias name - that rule stopped working, and all traffic was blocked from that point until a full reboot was done. <br />Once rebooted, old nat/access rules are working again using a new alias.</p> pfSense - Feature #15068 (New): Show if an alias is currently in usehttps://redmine.pfsense.org/issues/150682023-12-05T22:36:42ZMarcelo Cury
<p>I would like to check if it is possible to include in a future release the ability to see if an alias is being used in a Firewall rule when checking the aliases page.<br />Perhaps also show the Track ID ? I think this would be a very nice feature to have.</p>
<p>As I see it, it would help a lot to track things, avoid exclusions of aliases that are in use and help to clean up.</p>
<p>Thanks.</p> pfSense - Feature #14952 (Pull Request Review): Firewall Alias Importhttps://redmine.pfsense.org/issues/149522023-11-08T05:03:00ZAdam Di Vizio
<p>Hi There,</p>
<p>When you create a new Alias in PFSENSE, you can click on import option where it gives you a text box to enter a bulk of IP addresses at a time. However, if you want to add multiple IP subnets or IP addresses to an existing alias, it currently doesn't have that option available in the GUI. The only two options is 1) Export the Alias information manually, edit the text file with the additional subnets, delete the current alias then copy the entire file again and manually create the bulk alias again or 2) manually add each individual IP address or IP subnets to an existing firewall alias.</p>
<p>I would like to see an option available where I can add bulk subnets or IP address to an existing alias as it can be beneficial for people like me who uses Snort IDS.</p>
<p>Thanks,<br />Adam</p> pfSense - Bug #14734 (New): Alias FQDN resolving issue results in incomplete tableshttps://redmine.pfsense.org/issues/147342023-08-31T13:59:20ZRobert Gijsen
<p>In CE 2.7.0, there are still issues when FQDN are used in aliasses. Vonsider an alias with 3 entries, 2 static IP's and one FQDN, pointing to one of those IP's as well. When the FQDN changes to the other IP, the IP it had initially is gone from the table.</p>
<p>Steps to reproduce:</p>
Create an alias
<ul>
<li>add 1.1.1.1</li>
<li>add 8.8.8.8</li>
<li>add a (public) dns entry you created, pointing to 1.1.1.1, ie pfsensetest.domain.com</li>
<li>monitor the table-entry for the alias, all will be ok</li>
<li>now change the DNS entry for pfsensetest.domain.com from 1.1.1.1 to 8.8.8.8 and wait for it to be replicated and pfSense to pick it up</li>
<li>in my setups, 1.1.1.1 got deleted from the table. So while 8.8.8.8 is in there 'twice' now, and 1.1.1.1 only once statically, it's not there anymore</li>
<li>killing filterdns and reloading filters repopulates the tables correctly it seems.</li>
</ul>
<p>It looks like when the FQDN is resolved, it overrules the static entry if one with the same value exists, and when the FQDN changes, the static entry is not put back in to the table. I tailed resolver.log while reproducing the issue, but it made no notion at all of resolving the FQDN to another IP. So I don't know what log to add, or which log to enable verbose logging for.</p>
<p>I consider this high priority, as it has high potential of actually functionally breaking an environment.</p> pfSense - Feature #14444 (New): Aliases options for custom OS fingerprints?https://redmine.pfsense.org/issues/144442023-06-02T14:59:34ZJonathan Lee
<p>Idea for new feature, is there a way to add some custom fingerprints? I was able to find one manually but how can I add it? Maybe just for what we use on the network? Example: 200 machines that use the same Windows 11 OS and a system admin adds in that fingerprint for an ACL to pass traffic for only Windows 11. With such options the firewall in theory can block and distinguish between different Operating Systems. Take for example Docker containers with the new bleeding edge container of Kali's pentesting OS, something like that can data marshal the NIC card on a machine. Docker for one does not have the same fingerprints as the primary OS so in theory the firewall would know what traffic to allow and what to stop at an OS level even with the newest Docker containers. It is harder to spoof a custom fingerprint as the invasive actor would not know what is in use, and to just add that in would give users that full security tool back, Thus, Aliases options for OS fingerprints.</p>
<p>running: <strong>p0f -i (intrface)</strong></p>
<p>Outputs this example of what would be used with OS aliases: <strong>4:63+1:0:1460:65228,7:mss,nop,ws,sok,ts: :0</strong><br />this is freeBSD 13.12 on Hypervisor V</p>
<p>The database just needs some updated signatures, the software still works great so the tool and features already built in should work great still.<br />How can I just add in the signatures I need as an Aliases and link them to the access control lists?</p> pfSense - Feature #14152 (New): Add a way to find where an alias is used in the GUIhttps://redmine.pfsense.org/issues/141522023-03-22T08:19:10ZJon Brown
<p>I would like the ability to find where an alias is used via the GUI. I imagine a button next to the other alias option buttons on the alias page or perhaps a modal like when you hover over a firewall rules.</p>
<p>Mechanisms that can help:</p>
<ul>
<li>Download a backup and then search the XML.
<ul>
<li>I have used this. </li>
<li>perhaps the process of creating the backup and then grep the file could be utilised internally in pfSense</li>
</ul>
</li>
<li>when you try and delete an alias that is in use it fails
<ul>
<li>this is because pfSense knows it is in use.</li>
<li>perhaps this mechanism could be utilised to show the usage of the alias</li>
</ul></li>
</ul>
<p>This was originally posted 10 years ago but I think it was closed because a patch was posted but it was for a different issue. <a class="issue tracker-2 status-7 priority-4 priority-default closed" title="Feature: Add a way to find where an alias is used (Needs Patch)" href="https://redmine.pfsense.org/issues/2640">#2640</a></p> pfSense - Bug #13772 (Confirmed): Changing the alias resolve interval to the default value does n...https://redmine.pfsense.org/issues/137722022-12-18T11:52:17ZMarcos M
<p>Under <code>System / Advanced / Firewall & NAT</code>, if the <code>Aliases Hostnames Resolve Interval</code> option is changed from a custom value to a blank (default) value, <code>filterdns</code> processes are not restarted. Changes to custom values do correctly restart the processes.</p> pfSense - Feature #13732 (New): Allow the use of macros within aliaseshttps://redmine.pfsense.org/issues/137322022-12-07T11:33:09ZLuc Courville
<p>Because of limitation of IPv6 at the current way. (Traffic is allow between Vlan) I found a solution but this will be better if we can have more flexibility.</p>
<p>Can you make the option to create an Alias with Interface net and interface address.(drop down list) (same as when we create rules in destination drop down list) (ex: This Firewall, any, Alias or host, interface_name net....)<br />That way when we create a alias we choose Lan net, dmz net....<br />After that we can create a any rules with that alias.</p>
<p>There is my workaround about ipv6 traffic. <br /><img src="https://redmine.pfsense.org/attachments/download/4558/clipboard-202212071225-g4pv3.png" alt="" /><br />I create an interface group and add all local net. (Dynamic ipv6 from ISP)<br />Then create all rules for my need and it seem to work.</p>
<p>All other tab is reserved to IPv4 only.</p>
<p>If we can have alias as request the correct rules could be in tab interface instead of having lots of deny rules.</p>
<p>Best way to have the same behavior as we have in ipv4 (block all communication between vlan).</p> pfSense - Feature #10918 (New): IP Aliases de-duplicationhttps://redmine.pfsense.org/issues/109182020-09-20T00:00:19ZNima Mohammadinimamhd@gmail.com
<p>when i add an IP Aliases with duplicate or same IP-address, it will add those IPs without any warning about duplicate entries.</p>
<p>I think it is much better to prevent duplicate IPs in Aliases.</p> pfSense - Feature #10290 (New): Firewall Aliases Add button on top of listhttps://redmine.pfsense.org/issues/102902020-02-25T07:08:23ZConstantine Kormashev
<p>It would be good if we one more Add button would add on top of list. If adding new aliases happens often, then Add on top makes that process faster.<br />Probably it would be good adding "top" Add button to all Firewall aliases sections.</p> pfSense - Bug #7665 (New): Host range validation for Aliases is not strict enoughhttps://redmine.pfsense.org/issues/76652017-06-28T11:41:34ZRe Load
<p>Steps to reproduce:</p>
<p>1. Enter an invalid host range for an IP alias, such as 192.168.1.1-10, and click Save.</p>
<p>The host range will be accepted, but does not function as one might expect. In fact, the syntax is invalid and only the first host in the range will be matched by this alias.</p>
<p>Desired behaviour:</p>
<p>The host range should be rejected by the form validation. The correct syntax for the example above would be 192.168.1.1-192.168.1.10</p> pfSense - Feature #5735 (New): Automaticaly add DHCP leases to alias list or make it readable in ...https://redmine.pfsense.org/issues/57352016-01-05T05:21:42ZA Bdaywalker@eth0.io
<p>Hi<br />Last week I had a bigger Setup to deploy with some static DHCP Leases and a few Port forwarding's. I Just want to ask if it would be possible to automate the Process of creating (and linking of course) an Alias that belongs to a DHCP Lease.<br />Something like a system wide network object. Also Maybe fpr Subnets, and Ports of course.<br />But for now i struggled with having to enter everything twice (static DHCP leases and Aliases for the Firewall Rules)</p>
<p>Best regards</p> pfSense - Feature #4195 (New): Aliases: sectionshttps://redmine.pfsense.org/issues/41952015-01-09T08:15:16ZHollander Hollander
<p>G'day :D</p>
<p>My aliases are a mess; I have many of them, and I need to reorganize this. Now, one thing that is making it difficult to keep the overview is: the alias list (Firewall/Aliasses/All) <strong>can't be sorted alphabetically</strong>. It would be a dream if that were to be made possible :-)</p>
<p>The second improvement in this GUI would be to have some sort of <strong>section groups</strong> in this part of the Alias-GUI.</p>
<p>I've created an example in Excel and attached a screenshot, as a pic often says much more than 1000 words :-)</p>
<p>These two would help keep the overview and make it much more pleasant to work in this part of the GUI :-)</p>
<p>It means some fields need to be added to the alias records (and a check on duplicates + eventually drop down lists), and then the GUI needs to get these fields and that needs to be sortable.</p>
<p>(Yes, this too comes from my SAP experience :D).</p>
<p>Bye,</p> pfSense - Feature #1979 (New): Add some default read-only system aliaseshttps://redmine.pfsense.org/issues/19792011-10-25T13:42:20ZJim Pingle
<p>It would be useful to have some stock aliases that come by default which are not editable by users. These aliases would be somewhat of an extension to the choices we already have for things like "xxx Subnet" and "xxx Address".</p>
Some ideas:
<ul>
<li>Local Networks</li>
<li>ipv4_private (or perhaps rfc1918) - 192.168.0.0/16, 10.0.0.0/8, and 172.16.0.0/12</li>
<li>ipv6_linklocal - fe80::/10</li>
<li>ipv6_private - fc00::/7</li>
<li>ipv6_multicast - ff00::/8</li>
</ul>
<p>Having those available would save users from having to look them up, hardcode them, or make their own aliases for the same values on every system.</p>