pfSense bugtracker: Issueshttps://redmine.pfsense.org/https://redmine.pfsense.org/favicon.ico?16780521162024-02-21T03:59:00ZpfSense bugtracker
Redmine pfSense - Todo #15277 (New): Allow mixed source (URL (IPs), URL Table (IPs), Host(s) and Network(...https://redmine.pfsense.org/issues/152772024-02-21T03:59:00ZSergei Shablovsky
<p>Dear Brilliant pfSense DevTeam!</p>
<p>WHERE<br />in Firewall / Aliases</p>
<p>ARGUMENT <br />From firewall and user perspective there are two possible aliases:<br />- aliases for ports;<br />- aliases for IPs;<br />and pfSense make ability to entering both MANUALLY or AUTOMATICALLY by parsing the source (in PLAIN TXT, XML, JSON) himself.<br />And pfSense have WebGUI for entering this both.</p>
<p>From user perspective THE ALIASES ARE LOGICAL OBJECT TO GROUPING the IPs and ports.</p>
<p>FROM USER PERSPECTIVE would be useful mixed source of one type (for example URL (IPs), URL Table (IPs), Host(s) and Network(s) IN ONE ALIAS. <br />The same for Port(s), URL Port(s) and URL Table (Ports) - also IN ONE ALIAS.</p>
<p>EXAMPLE<br />Most external monitoring SaaS and servers/appliances manufacturers provide their services in a mixed form: FQDN + fixed IPs + fixed ports. <br />And if for ports LOGICALLY RIGHT to aggregate ports numbers in ONE ALIAS (for example StatusCake_PORT_MONITORING), for URLs would be also LOGICALLY RIGHT to aggregate IPs into ONE ALIAS (for example StatusCake_IP_MONITORING).</p>
<p>Page with example <a class="external" href="https://www.statuscake.com/kb/knowledge-base/what-are-your-ips/">https://www.statuscake.com/kb/knowledge-base/what-are-your-ips/</a></p>
<p>Otherwise pfSense user need to create 3(three!!!) separate aliases (URL (IPs), URL Table (IPs), Host(s)) for one service and after make + ANOTHER ONE alias for aggregating all 3(three) sources into one to using in pfSense firewall rules…<br />This significantly increase ability to mistyping/errors in process of rules configurations.</p>
<p>Thank You so much!</p> pfSense - Feature #15276 (New): Support JSON content for URL type firewall aliaseshttps://redmine.pfsense.org/issues/152762024-02-21T03:23:33ZSergei Shablovsky
<p>Brilliant pfSense DevTeam!</p>
<p>WHERE<br />In Firewall / Aliases, URLs tab(selector)</p>
<p>CASE<br />JSON need to be allowed in “URL (IPs)” type of firewall aliases, the same as XML and TXT are allowed.</p>
<p>ARGUMENT<br />Nowadays most SaaS and services present their data on JSON and XML more frequently than PLAIN TXT file answer on certain URL.<br />(For example external monitoring services.)</p>
<p>And logically wrong if pfSense user able to entering the XML and PLAIN TXT source in URL (IPs), but no JSON. (And only URL Table (IPs) allow the JSON).</p>
<p>I understand that from the beginning of pfSense’s life exist only 2 types of URL-sources:<br />- small lists<br />- big lists <br />and to eliminate time and resources to keep IPs, the parameter/ability of refresh of big lists was made in WebGUI.</p>
<p>But FROM USERS PERSPECTIVE all 3(JSON, XML and PLAIN TXT) source are the same - certain amount of data, and frustrating when possible to add XML and PLAIN TXT in URL (IPs), but JSON - only in another type, only in URL Table (IPs).</p>
<p>Thank You!</p> pfSense - Bug #15134 (Incomplete): Post upgrade to 2.7.2 - Change in alias name stops all traffichttps://redmine.pfsense.org/issues/151342024-01-03T11:03:01ZRajko Bogdanovicrajko@itroom-a.com
<p>After installing the last 2.7.2 release, when we edited an Alias name - that rule stopped working, and all traffic was blocked from that point until a full reboot was done. <br />Once rebooted, old nat/access rules are working again using a new alias.</p> pfSense - Feature #15068 (New): Show if an alias is currently in usehttps://redmine.pfsense.org/issues/150682023-12-05T22:36:42ZMarcelo Cury
<p>I would like to check if it is possible to include in a future release the ability to see if an alias is being used in a Firewall rule when checking the aliases page.<br />Perhaps also show the Track ID ? I think this would be a very nice feature to have.</p>
<p>As I see it, it would help a lot to track things, avoid exclusions of aliases that are in use and help to clean up.</p>
<p>Thanks.</p> pfSense - Feature #14952 (Pull Request Review): Firewall Alias Importhttps://redmine.pfsense.org/issues/149522023-11-08T05:03:00ZAdam Di Vizio
<p>Hi There,</p>
<p>When you create a new Alias in PFSENSE, you can click on import option where it gives you a text box to enter a bulk of IP addresses at a time. However, if you want to add multiple IP subnets or IP addresses to an existing alias, it currently doesn't have that option available in the GUI. The only two options is 1) Export the Alias information manually, edit the text file with the additional subnets, delete the current alias then copy the entire file again and manually create the bulk alias again or 2) manually add each individual IP address or IP subnets to an existing firewall alias.</p>
<p>I would like to see an option available where I can add bulk subnets or IP address to an existing alias as it can be beneficial for people like me who uses Snort IDS.</p>
<p>Thanks,<br />Adam</p> pfSense - Feature #14444 (New): Aliases options for custom OS fingerprints?https://redmine.pfsense.org/issues/144442023-06-02T14:59:34ZJonathan Lee
<p>Idea for new feature, is there a way to add some custom fingerprints? I was able to find one manually but how can I add it? Maybe just for what we use on the network? Example: 200 machines that use the same Windows 11 OS and a system admin adds in that fingerprint for an ACL to pass traffic for only Windows 11. With such options the firewall in theory can block and distinguish between different Operating Systems. Take for example Docker containers with the new bleeding edge container of Kali's pentesting OS, something like that can data marshal the NIC card on a machine. Docker for one does not have the same fingerprints as the primary OS so in theory the firewall would know what traffic to allow and what to stop at an OS level even with the newest Docker containers. It is harder to spoof a custom fingerprint as the invasive actor would not know what is in use, and to just add that in would give users that full security tool back, Thus, Aliases options for OS fingerprints.</p>
<p>running: <strong>p0f -i (intrface)</strong></p>
<p>Outputs this example of what would be used with OS aliases: <strong>4:63+1:0:1460:65228,7:mss,nop,ws,sok,ts: :0</strong><br />this is freeBSD 13.12 on Hypervisor V</p>
<p>The database just needs some updated signatures, the software still works great so the tool and features already built in should work great still.<br />How can I just add in the signatures I need as an Aliases and link them to the access control lists?</p> pfSense - Bug #14313 (Assigned): Unable to create nested URL table aliaseshttps://redmine.pfsense.org/issues/143132023-04-26T05:22:32ZAzamat Khakimyanov
<p>In docs there is a phrase:<br /><em>"URL table aliases can nest other URL table aliases, and URL aliases can nest other URL aliases."</em></p>
<p>I'm tested it on 23.01 and on 23.05-DEV and I can't create nested alias with 2 URL table aliases inside:</p>
<p>1. If I tried to create 'Type: Host(s)' alias, I got <br /><em>"The following input errors were detected:<br />The alias(es): urltest1 urltest2 cannot be nested because they are not of the same type."</em></p>
<p>2. If I tried to create 'Type: Network(s)' alias, there was no error but I didn't see this new alias in Diagnostics/Tables</p>
<p>3. If I tried to create 'Type: URL (IPs)' alias, I got <br /><em>"The following input errors were detected:<br />A valid URL or alias must be provided. Could not fetch usable data from 'urltest1'.<br />A valid URL or alias must be provided. Could not fetch usable data from 'urltest2'."</em></p>
<p>4. If I tried to create 'Type: URL Table (IPs)' alias and add one of these URL Table aliases I already created, I got<br /><em>"The following input errors were detected:<br />A valid URL must be provided."</em></p>
<p>5. If I tried to import aliases, I got no errors but I didn't see this new alias in Diagnostics/Tables</p> pfSense - Feature #14152 (New): Add a way to find where an alias is used in the GUIhttps://redmine.pfsense.org/issues/141522023-03-22T08:19:10ZJon Brown
<p>I would like the ability to find where an alias is used via the GUI. I imagine a button next to the other alias option buttons on the alias page or perhaps a modal like when you hover over a firewall rules.</p>
<p>Mechanisms that can help:</p>
<ul>
<li>Download a backup and then search the XML.
<ul>
<li>I have used this. </li>
<li>perhaps the process of creating the backup and then grep the file could be utilised internally in pfSense</li>
</ul>
</li>
<li>when you try and delete an alias that is in use it fails
<ul>
<li>this is because pfSense knows it is in use.</li>
<li>perhaps this mechanism could be utilised to show the usage of the alias</li>
</ul></li>
</ul>
<p>This was originally posted 10 years ago but I think it was closed because a patch was posted but it was for a different issue. <a class="issue tracker-2 status-7 priority-4 priority-default closed" title="Feature: Add a way to find where an alias is used (Needs Patch)" href="https://redmine.pfsense.org/issues/2640">#2640</a></p> pfSense - Bug #13772 (Confirmed): Changing the alias resolve interval to the default value does n...https://redmine.pfsense.org/issues/137722022-12-18T11:52:17ZMarcos M
<p>Under <code>System / Advanced / Firewall & NAT</code>, if the <code>Aliases Hostnames Resolve Interval</code> option is changed from a custom value to a blank (default) value, <code>filterdns</code> processes are not restarted. Changes to custom values do correctly restart the processes.</p> pfSense - Feature #13732 (New): Allow the use of macros within aliaseshttps://redmine.pfsense.org/issues/137322022-12-07T11:33:09ZLuc Courville
<p>Because of limitation of IPv6 at the current way. (Traffic is allow between Vlan) I found a solution but this will be better if we can have more flexibility.</p>
<p>Can you make the option to create an Alias with Interface net and interface address.(drop down list) (same as when we create rules in destination drop down list) (ex: This Firewall, any, Alias or host, interface_name net....)<br />That way when we create a alias we choose Lan net, dmz net....<br />After that we can create a any rules with that alias.</p>
<p>There is my workaround about ipv6 traffic. <br /><img src="https://redmine.pfsense.org/attachments/download/4558/clipboard-202212071225-g4pv3.png" alt="" /><br />I create an interface group and add all local net. (Dynamic ipv6 from ISP)<br />Then create all rules for my need and it seem to work.</p>
<p>All other tab is reserved to IPv4 only.</p>
<p>If we can have alias as request the correct rules could be in tab interface instead of having lots of deny rules.</p>
<p>Best way to have the same behavior as we have in ipv4 (block all communication between vlan).</p> pfSense - Feature #12564 (New): add column to show that an Alias is in use by or nothttps://redmine.pfsense.org/issues/125642021-12-04T08:14:01Zkhaled osama
<p>can you add column to show that an Alias is in used or not<br />and it is clickable to show where it is used ?</p>
<p>is it applicable ?</p>
<p>thanks and best regards,</p> pfSense - Feature #10918 (New): IP Aliases de-duplicationhttps://redmine.pfsense.org/issues/109182020-09-20T00:00:19ZNima Mohammadinimamhd@gmail.com
<p>when i add an IP Aliases with duplicate or same IP-address, it will add those IPs without any warning about duplicate entries.</p>
<p>I think it is much better to prevent duplicate IPs in Aliases.</p> pfSense - Feature #10290 (New): Firewall Aliases Add button on top of listhttps://redmine.pfsense.org/issues/102902020-02-25T07:08:23ZConstantine Kormashev
<p>It would be good if we one more Add button would add on top of list. If adding new aliases happens often, then Add on top makes that process faster.<br />Probably it would be good adding "top" Add button to all Firewall aliases sections.</p> pfSense - Feature #5735 (New): Automaticaly add DHCP leases to alias list or make it readable in ...https://redmine.pfsense.org/issues/57352016-01-05T05:21:42ZA Bdaywalker@eth0.io
<p>Hi<br />Last week I had a bigger Setup to deploy with some static DHCP Leases and a few Port forwarding's. I Just want to ask if it would be possible to automate the Process of creating (and linking of course) an Alias that belongs to a DHCP Lease.<br />Something like a system wide network object. Also Maybe fpr Subnets, and Ports of course.<br />But for now i struggled with having to enter everything twice (static DHCP leases and Aliases for the Firewall Rules)</p>
<p>Best regards</p> pfSense - Feature #4195 (New): Aliases: sectionshttps://redmine.pfsense.org/issues/41952015-01-09T08:15:16ZHollander Hollander
<p>G'day :D</p>
<p>My aliases are a mess; I have many of them, and I need to reorganize this. Now, one thing that is making it difficult to keep the overview is: the alias list (Firewall/Aliasses/All) <strong>can't be sorted alphabetically</strong>. It would be a dream if that were to be made possible :-)</p>
<p>The second improvement in this GUI would be to have some sort of <strong>section groups</strong> in this part of the Alias-GUI.</p>
<p>I've created an example in Excel and attached a screenshot, as a pic often says much more than 1000 words :-)</p>
<p>These two would help keep the overview and make it much more pleasant to work in this part of the GUI :-)</p>
<p>It means some fields need to be added to the alias records (and a check on duplicates + eventually drop down lists), and then the GUI needs to get these fields and that needs to be sortable.</p>
<p>(Yes, this too comes from my SAP experience :D).</p>
<p>Bye,</p>