pfSense

User gertjan found the Problem. See this Post: https://forum.netgate.com/topic/173842/problem-with-multiple-interfaces-since-version-22-05/9?_=1659518983176

I don't currently see this behavior in devel, unless I understand the problem incorrectly, but I do see a problem with the cpzone cpips alias omitting all but one interface IP. When I create a zone and assign two interfaces to it, I see this:

table <cpzoneid_2_cpips> { 192.168.61.1  }
ether pass on { vtnet0.60 vtnet0.61  } tag "cpzoneid_2_rdr" 
ether anchor "cpzoneid_2_auth/*" on { vtnet0.60 vtnet0.61  }
ether anchor "cpzoneid_2_passthrumac/*" on { vtnet0.60 vtnet0.61  }
ether anchor "cpzoneid_2_allowedhosts/*" on { vtnet0.60 vtnet0.61  }
rdr on vtnet0.60 inet proto tcp from any to ! <cpzoneid_2_cpips> port 80 tagged cpzoneid_2_rdr -> 192.168.60.1 port 8002
rdr on vtnet0.61 inet proto tcp from any to ! <cpzoneid_2_cpips> port 80 tagged cpzoneid_2_rdr -> 192.168.61.1 port 8002
pass in quick on vtnet0.60 proto tcp from any to <cpzoneid_2_cpips> port 8002 ridentifier 13001 keep state(sloppy)
block in quick on vtnet0.60 from any to ! <cpzoneid_2_cpips> ! tagged cpzoneid_2_auth ridentifier 13003
pass in quick on vtnet0.61 proto tcp from any to <cpzoneid_2_cpips> port 8002 ridentifier 13004 keep state(sloppy)
block in quick on vtnet0.61 from any to ! <cpzoneid_2_cpips> ! tagged cpzoneid_2_auth ridentifier 13006

As you can see, the ether, pass, block, and rdr rules were all appropriately created with both vtnet0.60 (lan1) and vtnet0.61 (lan2) interfaces, however the cpzonid_2_cpips alias only has vtnet0.61's (lan2) address 192.168.61.1.

Reading over the forum post again, I think I am actually seeing what you are describing - that the ips for the interfaces are not all being concatenated, not that the interfaces are missing rules, in which case I have a fix that makes the addresses concatenate correctly. As pointed out in the forum, $cpiplist was being reassigned every iteration over the interface list. I've made a slightly more thorough change that collects the IPs and VIPs into a list rather than directly concatenating the string, then joins it with spaces when it's concatenated to the rule output.

I have a change in CE right now that I'll be merging to Plus momentarily, and it should show up in the next build.