Project

General

Profile

Actions

Feature #11439

open

IPv6 support in ``easyrule`` CLI script

Added by Viktor Gurov 8 months ago. Updated about 2 months ago.

Status:
Feedback
Priority:
Normal
Assignee:
Category:
Rules / NAT
Target version:
Start date:
02/18/2021
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
21.09
Release Notes:
Default

Description

https://forum.netgate.com/topic/160578/getting-errors-loading-rules-after-using-easyrule:

I recently tried to use easyrule to add a firewall rule to my SG1100 from the command line.

Easyrule itself didn't report an error, but since then I am getting rule expands to no valid combination errors, and the rule that's causing the problems is not visible in the GUI, so I can't delete it.

Specifically:

There were error(s) loading the rules: /tmp/rules.debug:180: rule expands to no valid combination
The line in question reads [180]:
pass in quick on $WAN reply-to ( mvneta0.4090 <router-ipv4-addr> ) inet proto tcp from any to <client-ipv6-addr>/128 tracker 1612037148 flags S/SA keep state label 'USER_RULE: Easy Rule: Passed from Firewall Log View'

I can see that this rule makes no sense because it mixes IPv4 and IPv6, but how can I get rid of it, /tmp/rules.debug is only a dump...

I eventually found the rule in /cf/conf/config.xml:

<rule>                                                                      
        <type>pass</type>                                                   
        <interface>wan</interface>                                          
        <ipprotocol>inet</ipprotocol>                                       
        <descr><![CDATA[Easy Rule: Passed from Firewall Log View]]></descr> 
        <protocol>tcp</protocol>                                            
        <source>                                                            
                <any></any>                                                 
        </source>                                                           
        <destination>                                                       
                <address>{client-ipv6-addr}/128</address>                   
        </destination>                                                      
        <created>                                                           
                <time>1612037148</time>                                     
                <username><![CDATA[Easy Rule]]></username>                  
        </created>                                                          
        <tracker>1612037148</tracker>                                       
</rule>                                                                    

The root account doesn't keep any history, so I don't know exactly which easyrule command I used, but as best I can recall, all I did was:

easyrule pass wan tcp any <ipv6-addr>

As far as I can tell, easyrule doesn't mention IPv6.

Actions #2

Updated by Viktor Gurov 8 months ago

  • Status changed from New to Pull Request Review
Actions #3

Updated by Jim Pingle 7 months ago

  • Tracker changed from Bug to Feature
  • Subject changed from easyrule doesn't mention IPv6 to IPv6 support in easyrule CLI script
  • Target version set to CE-Next
  • Affected Version deleted (2.5.0)
Actions #4

Updated by Renato Botelho 4 months ago

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Viktor Gurov
  • Target version changed from CE-Next to 2.6.0
  • Plus Target Version set to 21.09

PR has been merged. Thanks!

Actions #5

Updated by Jim Pingle about 2 months ago

  • Subject changed from IPv6 support in easyrule CLI script to IPv6 support in ``easyrule`` CLI script

Updating subject for release notes.

Actions

Also available in: Atom PDF