search

Rosa-Luxemburgstiftung-Berlin / ansible-opnsense

Ansible role to configure OPNsense firewalls
17 stars 8 forks source link

URL Firewall Aliases not workng #51

Closed rvalle closed 8 months ago

rvalle commented 8 months ago

When creating URL aliases that load Tables, such as:

opn_alias:

  # Blacklists

  - uuid: 0d561ada-f0e4-11e9-b9f0-00051b40070c
    settings:
      - key: name
        value: spamhouse_drops
      - key: type
        value: urltable
      - key: updatefreq
        value: "0.041666666666666664"
      - key: content
        list:
          - https://www.spamhaus.org/drop/drop.txt
          - https://www.spamhaus.org/drop/edrop.txt
      - key: description
        value: Spamhouse Drop and EDrop blacklists

The alias will be created but it wont be loaded up. This type of rule needs to be "applied" from the web ui for tables to be instantiated, for some reason.

zerwes commented 8 months ago

Hello Rafael We use the urltable alias type too, but we deploy them as a initial cfg and this way we newer had problems. Do you deploy the full playbook including the sync and reload task? Are they working as expected after a reboot?

zerwes commented 8 months ago

looks like it is time for #12 to be transitioned from just a nice idea to wip ...

zerwes commented 8 months ago

Hello @rvalle This is fixed in the PR #53

But before your example can work, you must add

  - key: enabled
    value: '1'

to your alias settings

Greetings Klaus

zerwes commented 8 months ago

@rvalle w/ PR #54 a undefined enabled setting in aliases is now considered (like in opnsense) as enabled

rvalle commented 8 months ago

Sorry @zerwes just saw your replies... I did not notice the "enablement". will check and test.

rvalle commented 8 months ago

Tested it on OPNsense 23.7.10_1-amd64 and it works fine.

Before I did not notice the "enabled", because the UI is in fact listing the alias as enabled, but anyway, great to see it is working!

zerwes commented 8 months ago

Hello @rvalle, thank you for the confirmation

Before I did not notice the "enabled", because the UI is in fact listing the alias as enabled

Yes, somehow the missing enabled tag for aliases in opnsense seems to be inconsistent. I tested the new handler first with one of mine definitions, but it took me ages to find out why yours is still not working ...

Anyhow, with #54 this should be fixed.