Skip to content

[pfsense_rule]: Cannot use IPv6 in source and destination #219

Description

@SUedurable

Describe the bug
Cannot put a raw IPv6 network or IP in pfsense_rule.
Getting Cannot parse address 2001:db8::/32.

Expected behavior
The rule added to pfsense as in IPv4.

Playbook
Please paste a minimal playbook to reproduce the issue:

The following simple playbook doesn't work:

- name: Setup pfsense
  hosts: "pfsense"
  tasks:
    - name: IPv6 Traffic
      pfsensible.core.pfsense_rule:
        name: 'IPv6 traffic'
        action: pass
        destination: 2001:db8::/32
        ipprotocol: inet6
        interface: WAN
        protocol: any
        source: any

The same playbook in IPv4 works:

- name: Setup pfsense
  hosts: "pfsense"
  tasks:
    - name: IPv4 Traffic
      pfsensible.core.pfsense_rule:
        name: 'IPv4 traffic'
        action: pass
        destination: 192.0.2.0/24
        ipprotocol: inet
        interface: WAN
        protocol: any
        source: any

Output
Please paste the ansible output run with -vv:

Details

ansible-playbook [core 2.19.4]
  config file = /home/vdoreau/code/infra/ansible.cfg
  configured module search path = ['/home/vdoreau/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3/dist-packages/ansible
  ansible collection location = /home/vdoreau/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible-playbook
  python version = 3.13.5 (main, Jun 25 2025, 18:55:22) [GCC 14.2.0] (/usr/bin/python3)
  jinja version = 3.1.6
  pyyaml version = 6.0.2 (with libyaml v0.2.5)
Using /home/vdoreau/code/infra/ansible.cfg as config file
Skipping callback 'minimal', as we already have a stdout callback.
Skipping callback 'oneline', as we already have a stdout callback.

PLAYBOOK: edge.yml ***************************************************************************************
1 plays in playbooks/internal/edge.yml

PLAY [Setup pfsense] *************************************************************************************

TASK [Gathering Facts] ***********************************************************************************
task path: /home/vdoreau/code/infra/playbooks/internal/edge.yml:1
Sunday 30 November 2025  14:31:54 +0100 (0:00:00.008)       0:00:00.008 *******
ok: [pfsense]

TASK [IPv6 Traffic] **************************************************************************************
task path: /home/vdoreau/code/infra/playbooks/internal/edge.yml:4
Sunday 30 November 2025  14:32:02 +0100 (0:00:07.626)       0:00:07.634 *******
[ERROR]: Task failed: Module failed: Cannot parse address 2001:db8::/32
Origin: /home/vdoreau/code/infra/playbooks/internal/edge.yml:4:7

2   hosts: "pfsense"
3   tasks:
4     - name: IPv6 Traffic
        ^ column 7

fatal: [pfsense]: FAILED! => {"changed": false, "msg": "Cannot parse address 2001:db8::/32"}

PLAY RECAP ***********************************************************************************************
pfsense    : ok=1    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0


TASKS RECAP **********************************************************************************************
Sunday 30 November 2025  14:32:03 +0100 (0:00:01.785)       0:00:09.420 *******
===============================================================================
Gathering Facts ----------------------------------------------------------------------------------- 7.63s
/home/vdoreau/code/infra/playbooks/internal/edge.yml:1 --------------------------------------------------
IPv6 Traffic -------------------------------------------------------------------------------------- 1.79s
/home/vdoreau/code/infra/playbooks/internal/edge.yml:4 --------------------------------------------------

Environment

  • What version of pfsensible.core?
    0.7.1
  • What version of ansible?
    2.19.4
  • What version of pfSense?
    2.8.1

Additional context
A single IP gives the same error.
This is due to the handling or port by splitting on : here:

addr = param.split(':')

Interestingly, pfsense_alias doesn't have the same problem, so as a workaround, one could create an ipv6 alias and use this alias in the rule. The following playbook works fine:

Details

- name: Setup pfsense
  hosts: "pfsense"
  tasks:
    - name: IPv6 subnet alias
      pfsensible.core.pfsense_alias:
        name: ipv6_subnet
        type: network
        address: 2001:db8::/32

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions