Firewall Aliases¶
Aliases are named placeholders for IP addresses, networks, or ports. They can be used anywhere an address is accepted in firewall rules, NAT rules, and traffic shaper rules.
Web UI location¶
Firewall > Aliases
Purpose¶
Without aliases, changing a commonly-used address (such as a server IP) requires editing every rule that references it. With an alias, you update one entry and all referencing rules update automatically.
Creating an alias¶
| Field | Notes |
|---|---|
| Name | Identifier used in rules; alphanumeric and underscores only |
| Address | One or more IP addresses or CIDR networks |
| Description | Human-readable purpose |
Multiple addresses can be added to a single alias. The alias represents the union of all listed addresses.
Using aliases in rules¶
In firewall rule source/destination fields, a blue background on the input box indicates an alias lookup is active. Type the alias name to select it.
An alias can be used in: - Firewall rules (source, destination) - NAT rules (source, destination, redirect target) - Traffic shaper rules (source, destination)
Chaining aliases¶
An alias can reference another alias by name. This allows hierarchical groupings — for example, a servers alias that contains webservers and dbservers aliases.
Chained aliases are resolved at rule evaluation time. If an alias references an invalid or undefined name, rules depending on it are skipped.
IP Pools vs aliases¶
Both aliases and IP Pools represent sets of addresses, but they serve different purposes:
| Aliases | IP Pools | |
|---|---|---|
| Backend | Rule expansion | pf table (<tablename>) |
| Populated by | Manual entry | Manual or DNS forwarder mapping |
| Dynamic updates | No | Yes (DNS forwarder can update at resolution time) |
| Use case | Static address groups in rules | Dynamic FQDN-based policy enforcement |
Use an alias when the addresses are fixed and known. Use an IP Pool when addresses need to be populated dynamically (e.g., mapping a hostname to its current resolved IPs and enforcing policy against that set).
See DNS Forwarder, IP Pools, and pf Tables for IP Pool details.
Deletion¶
An alias cannot be deleted while it is in use by any firewall rule, NAT rule, or shaper rule. The UI will warn which rules reference the alias. Remove or update those rules first, then delete the alias.
Apply¶
Alias changes require clicking Apply before they take effect in the running firewall. A banner appears when there are unapplied changes.