Project

General

Profile

Actions
Copy link

Bug #8386

closed

Virtual IPs not considered as part of interface net

Added by Stefan Kooman over 6 years ago. Updated 4 months ago.

Status:
Not a Bug
Priority:
Normal
Assignee:
-
Category:
Rules / NAT
Target version:
-
Start date:
03/22/2018
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.2_1
Affected Architecture:

Description

Every network interface with ips configured has a variable "INTERFACE net" which can be used in firewall rules to select all associated ips on that interface. Currently, Virtual IPs (and or virtual IP ranges) bound on a INTERFACE are not considered to be part the "net" of that INTERFACE. I would expect that all associated IPs (be it virtual or not) should belong to the "net" of an interface. This can be work around by creating a new alias which includes all network ranges and replacing the "INTERFACE net" variable in the ruleset, but this is error prone, as future Virtual IPs might get forgotten to be added to this new alias.

Actions
Copy link
 #1

Updated by Jim Pingle over 5 years ago

  • Category set to Rules / NAT
  • Status changed from New to Not a Bug

They are included:

On a system with a WAN address of 198.51.100.7/24 and an IP alias VIP of 198.18.0.3/24:

pass  in  quick  on $WAN reply-to ( em0 198.51.100.1 ) inet proto tcp  from any to { 198.51.100.0/24 198.18.0.0/24 } tracker 1565797002 flags S/SA keep state  label "USER_RULE: test pass to WAN net"
Actions
Copy link
 #2

Updated by Stefan Kooman 4 months ago

Me again. So recently I bumped into this issue again. And apparently another user as well. So as IPv4 is added as you and I have double checked, the same is not true for IPv6. See this forum post: https://forum.netgate.com/topic/184497/bug-ipv6-virtual-subnet-not-added-to-interface-subnet

So the issue is that IPv6 addresses are not added.

Actions
Copy link

Also available in: Atom PDF