pfSense

Danilo Zrenjanin wrote in #note-1:

I couldn't confirm that behavior on the 23.09.1 pfSense Plus release.

Hey Danilo, thank you for checking this bug. I should have clarified something, I did not know this diagnostic page you just posted existed. The issue I encountered was when I wanted to route specific clients through specific VPN tunnels based on hosts in an Alias it did not work.

Aka example.com in an alias, all clients going to example.com should be diverted from WAN to OpenVPN for that domain, still accessing it via WAN instead.

So I assumed the domains were not being resolved but perhaps the bug is elsewhere? - If you can check this in some way I would appreciate it and I apologise for not knowing about the diagnostic tables page or I would have been more specific with my bug report.

Marcos M wrote in #note-3:

Aka google.com in an alias, all clients going to google.com should be diverted from WAN to OpenVPN for that domain, still accessing it via WAN instead.

This won't work due to the use of CDNs and many different sub/domains used to access the service. For something like that, it's better to use e.g. the ASN.

Hi Marcus,

I only picked google.com as an example domain, it's not the actual domain I'm trying to divert. I'm using domains that only have a single IP and it works every time for all of them but only on the older pfSense release and not the latest.

It's working on 10+ domains in the old release, broken instantaneously with new release, all hostnames/ips' in the alias table are ignored by the firewall rule as if they do not exist. I can literally reboot the firewall into the old release using the snapshot feature and it works, go back to the new release, broken etc

So if someone wants to pick a domain they know only has a few IP's etc - try that.

Marcos M wrote in #note-5:

It may be best to troubleshoot/discuss further on the forums to narrow down the issue given that we cannot reproduce it.

Dear Marcus,

Have you tested it though? as the issue isn't that the IP's don't show in the Alias table, it's that the firewall does not react to them and route traffic based on what is in the alias table.

Steve Wheeler wrote in #note-7:

Unable to replicate that in 23.09.1:

Thank you Steve, I have reinstalled 23.09.1 and I too am unable to replicate the bug that I first reported here. I apologise for wasting everyone's time I can only assume the issue I experienced was caused by something else which I cannot replicate now.

If I face issues in the future I will make a forum post before I create a bug report to not waste the developer's time. Thanks!