Project

General

Profile

Bug #7118

ICMP rule with ICMP type "any" fails to load

Added by Tobias Wigand 8 months ago. Updated 8 months ago.

Status:
Resolved
Priority:
High
Assignee:
-
Category:
Rules/NAT
Target version:
Start date:
01/13/2017
Due date:
% Done:

100%

Affected version:
2.4
Affected Architecture:
amd64

Description

Creating a pass rule with ICMP and ICMP type any prevents the ruleset from being loaded.
The following rule is generated and fails:

pass  in  quick  on $LAN inet proto icmp  from 192.168.1.0/24 to any icmp-type any tracker 1484287460 keep state  label "USER_RULE: Allow ICMP " 

I think "icmp-type any" is wrong and should be left out to match all ICMP traffic.

The rule should look like it does in 2.3:

pass  in  quick  on $LAN inet proto icmp  from 192.168.1.0/24 to any tracker 1416374361 keep state  label "USER_RULE: Allow ICMP" 

Associated revisions

Revision 007cfb6a
Added by Phillip Davis 8 months ago

Fix #7118 icmp-type any

When 'any' is selected as the ICMP type, do not write 'icmp-type any' in the rule, just leave it out.

Revision e1568616
Added by Phillip Davis 8 months ago

Fix #7118 icmp-type any

When 'any' is selected as the ICMP type, do not write 'icmp-type any' in the rule, just leave it out.

History

#2 Updated by Tobias Wigand 8 months ago

Works fine now. Many thanks, Phil!

#3 Updated by Phillip Davis 8 months ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100

#4 Updated by Jim Pingle 8 months ago

  • Status changed from Feedback to New

This still fails for me after a gitsync.

There were error(s) loading the rules: /tmp/rules.debug:189: syntax error - The line in question reads [189]: pass in quick on $WAN reply-to ( vmx0 198.51.100.1 ) inet proto icmp from any to 1.2.3.4 icmp-type any tracker 1484267245 keep state label "USER_RULE"

#5 Updated by Jim Pingle 8 months ago

  • Status changed from New to Resolved

OK, nevermind, I ran it again and it's fine. The sync didn't pick that up.

github has been spazzing out today, the first sync probably didn't get anything new.

Also available in: Atom PDF