Regression #12937
closedTraffic Shaper wizard can produce an invalid ruleset when configured with an IPv4 upstream SIP server
Added by Danilo Zrenjanin over 4 years ago. Updated over 4 years ago.
100%
Description
After running the traffic shaper wizard and defining an Upstream SIP server IP address under the VOIP specific settings, inappropriate floating rules will be created. Which will prevent the firewall filter from reloading.
It fails with the following log:
There were error(s) loading the rules: /tmp/rules.debug:146: rule expands to no valid combination - The line in question reads [146]: match inet6 proto udp from 192.168.33.20 to any ridentifier 1646990408 queue (qVoIP) label "USER_RULE: Connections From Upstream SIP Server"
It looks like the Wizard defines rules using IPv4+IPv6 Address Family, which can be used only with aliases.
JP Updated by Jim Pingle over 4 years ago Actions #1
- Plus Target Version changed from 21.02 to 22.05
VG Updated by Viktor Gurov over 4 years ago Actions #2
- Tracker changed from Bug to Regression
- Assignee set to Viktor Gurov
VG Updated by Viktor Gurov over 4 years ago Actions #3
- Related to Feature #4769: IPv6 support in the Traffic Shaper Wizard added
JP Updated by Jim Pingle over 4 years ago Actions #4
- Status changed from New to Pull Request Review
VG Updated by Viktor Gurov over 4 years ago Actions #5
- Status changed from Pull Request Review to Feedback
JP Updated by Jim Pingle over 4 years ago Actions #6
- Subject changed from Traffic Shaper basic Wizard rules to Traffic Shaper wizard can produce an invalid ruleset when configured with an IPv4 upstream SIP server
Updating subject for release notes.
VG Updated by Viktor Gurov over 4 years ago Actions #7
- % Done changed from 0 to 100
Applied in changeset commit:030fab3edaee1c2f10ea8695a041864810d94390.
MM Updated by Marcos M over 4 years ago Actions #8
Tested on 22.05.a.20220410.0600.
There are still places where it fails:
There were error(s) loading the rules: /tmp/rules.debug:230: rule expands to no valid combination - The line in question reads [230]: match inet6 proto udp from any to 10.0.5.200 ridentifier 1649625457 queue (qVoIP) label "id:1649625457" label "USER_RULE: Connections To Upstream SIP Server"
Additionally:There were error(s) loading the rules: /tmp/rules.debug:227: rule expands to no valid combination - The line in question reads [227]: match on { vmx1 vmx3.521 } inet6 from 10.0.5.200 to any ridentifier 1649625679 queue (qOthersLow) label "id:1649625679" label "USER_RULE: Penalty Box"
- Using the
Penalty Boxoption results in a floating rule using the queueqOthersLowwhich does not exist. - Floating rules without a specific interface should be created with the
Anyinterface selected instead.
MM Updated by Marcos M over 4 years ago Actions #9
- Status changed from Feedback to New
VG Updated by Viktor Gurov over 4 years ago Actions #10
Marcos Mendoza wrote in #note-8:
Additionally:
- Using the
Penalty Boxoption results in a floating rule using the queueqOthersLowwhich does not exist.- Floating rules without a specific interface should be created with the
Anyinterface selected instead.
fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/708
JP Updated by Jim Pingle over 4 years ago Actions #11
- Status changed from New to Pull Request Review
VG Updated by Viktor Gurov over 4 years ago Actions #12
- Status changed from Pull Request Review to Feedback
MM Updated by Marcos M over 4 years ago Actions #13
Everything works except for:
Floating rules without a specific interface should be created with the Any interface selected instead.
For reference, the option that created the empty interface list is the VOIP rules one.
VG Updated by Viktor Gurov over 4 years ago Actions #14
- Status changed from Feedback to New
Marcos Mendoza wrote in #note-13:
Everything works except for:
Floating rules without a specific interface should be created with the Any interface selected instead.
For reference, the option that created the empty interface list is the VOIP rules one.
fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/723
JP Updated by Jim Pingle over 4 years ago Actions #15
- Status changed from New to Pull Request Review
VG Updated by Viktor Gurov over 4 years ago Actions #16
- Status changed from Pull Request Review to Feedback
→L Updated by → luckman212 over 4 years ago Actions #17
Is this at all related to https://redmine.pfsense.org/issues/13026 ? I am eager to have limiters working again on 22.05 snaps, sorry to be a PITA.
MM Updated by Marcos M over 4 years ago Actions #18
- Status changed from Feedback to New
The VOIP rules were created with the Any interface. However, this error is back now:
There were error(s) loading the rules: /tmp/rules.debug:221: rule expands to no valid combination - The line in question reads [221]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650416745 queue (qDefault) label "id:1650416745" label "USER_RULE: Penalty Box"
@ 2022-04-19 20:05:47
and with with "Others" option enabled:
There were error(s) loading the rules: /tmp/rules.debug:229: rule expands to no valid combination - The line in question reads [229]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650417190 queue (qOthersLow) label "id:1650417190" label "USER_RULE: Penalty Box"
@ 2022-04-19 20:13:12
VG Updated by Viktor Gurov over 4 years ago Actions #19
Marcos Mendoza wrote in #note-18:
The VOIP rules were created with the
Anyinterface. However, this error is back now:There were error(s) loading the rules: /tmp/rules.debug:221: rule expands to no valid combination - The line in question reads [221]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650416745 queue (qDefault) label "id:1650416745" label "USER_RULE: Penalty Box"
@ 2022-04-19 20:05:47
and with with "Others" option enabled:
There were error(s) loading the rules: /tmp/rules.debug:229: rule expands to no valid combination - The line in question reads [229]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650417190 queue (qOthersLow) label "id:1650417190" label "USER_RULE: Penalty Box"
@ 2022-04-19 20:13:12
fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/728
JP Updated by Jim Pingle over 4 years ago Actions #20
- Status changed from New to Pull Request Review
VG Updated by Viktor Gurov over 4 years ago Actions #21
- Status changed from Pull Request Review to Feedback
JP Updated by Jim Pingle over 4 years ago Actions #22
- Status changed from Feedback to Resolved
Works now
Also available in: Atom