pfSense Rule Switch

Share your Projects!
5

Has anyone actually got this working recently?

I can query the fauxapi from my MacBook fine but HomeAssistant will not play ball.

It pulls the rule through as a switch OK, despite multiple entires of

Problem retrieving rule set from pfSense host: X.X.X.X. Likely due to API key or secret.

If you try and do anything with said switch you get this error:

'tracker'
Traceback (most recent call last):
  File "/usr/src/homeassistant/homeassistant/components/websocket_api/commands.py", line 130, in handle_call_service
    connection.context(msg),
  File "/usr/src/homeassistant/homeassistant/core.py", line 1260, in async_call
    task.result()
  File "/usr/src/homeassistant/homeassistant/core.py", line 1295, in _execute_service
    await handler.func(service_call)
  File "/usr/src/homeassistant/homeassistant/helpers/entity_component.py", line 209, in handle_service
    self._platforms.values(), func, call, required_features
  File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 454, in entity_service_call
    future.result()  # pop exception if have
  File "/usr/src/homeassistant/homeassistant/helpers/entity.py", line 595, in async_request_call
    await coro
  File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 485, in _handle_entity_call
    await result
  File "/usr/src/homeassistant/homeassistant/helpers/entity.py", line 621, in async_turn_on
    await self.hass.async_add_executor_job(ft.partial(self.turn_on, **kwargs))
  File "/usr/local/lib/python3.7/concurrent/futures/thread.py", line 57, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/config/custom_components/pfsense_rule/switch.py", line 126, in turn_on
    self.set_rule_state(True)
  File "/config/custom_components/pfsense_rule/switch.py", line 171, in set_rule_state
    if (rule['tracker'] == self._tracker_id):
KeyError: 'tracker'

Tried with different versions of fauxapi, different versions of pfSense and also tried a mate who also has home assistant and pfSense but he gets the same errors. Tried adding PfsenseFauxapi to the config directory but still no dice.

My Python skills aren’t very good so hoping someone can point me in the right direction.

6

double check the permissions on the key created in pfsense. If I recall correctly, the key gets added with virtually no permissions.

7

Also, I assume that you’re not trying to use one of the PFFAExample keys?

8

Yeah using my own key which works fine if I put it in the string and query Pfsense from my MacBook‘s terminal.
I’ve tried various keys and secrets and various permissions on the key. Tried just rules on its own, tried * and also tried adding everything manually like one of the examples.
It’s almost like HomeAssistant isn’t loading the right Python libraries or something.

9

I have the same problem, did you solve it @crag-r?

It seems the code tries to retrieve the ‘tracker’ field from the rule dictionary but no such value has been defined (when iterating over the list of rules received from PFSense). I believe the API has changed or maybe theirs something wrong with the data. I don’t know what the tracker-field does…

10

I found the problem, the code expects all rules to have the tracker property set (is used as a rule-identifier) but not all rules have that property set. For me, it was the “OpenVPN wizard” that created the problem.

To fix it, search for (in switch.py):

for rule in filters['rule']:

And replace the code after with:

for rule in filters['rule']:
            tracker = rule.get('tracker')
            if tracker == None:
                _LOGGER.error("Skipping rule (no tracker_id): " + rule['descr'])
            else:
                if rule_prefix:
                    if (rule['descr'].startswith(rule_prefix)):
                        _LOGGER.debug("Found rule %s", rule['descr'])
                        new_rule = pfSense('pfsense_'+rule['descr'], rule['descr'], tracker, host, api_key, access_token)
                        rules.append(new_rule)
                else:
                    _LOGGER.debug("Found rule %s", rule['descr'])
                    new_rule = pfSense('pfsense_'+rule['descr'], rule['descr'], tracker, host, api_key, access_token)
                    rules.append(new_rule)
            i=i+1

This code simply skips these rules and will also log an error if a rule don’t have the tracker attribute.

Perhaps @dgshue could update the code in the repo?

EDIT:
You also need to replace all:

rule['tracker']

with

rule.get('tracker')
1 Like
11

I’ll give this a go tomorrow!

12

Dude -

Thank you so much for this. These components and switches are huge for me and I’ve been migrating to a new pfSense setup this week and yesterday it worked but today it wouldn’t. I couldn’t figure out why. I’d run the OpenVPN wizard late last night. I made the changes you noted and it seems to be working again.

@dgshue As always - thanks for your efforts on these!

13

On another note, does anyone know if this will work on OPNsense as well?

14

So looking into it more deeply, it doesn’t look like it would run in OPNsense without some pretty major changes to leverage their API. Since this alone is pretty much keeping me on pfSense vs. OPNsense the next question is - will it work on pfSense 2.5? This is so key for me it’s also the only thing that has kept me from upgrading.

15

In pfsense once you edit a firewall rule you usually have the clear the system states (Diagnostics->States->Reset States) for it to take effect immediately.

Once you toggle the rule to block access for your kids, does it take effect right away?

16

Sorry for the late reply but thanks Fredrik your fix is working perfectly

17

How do you target a specific rule in pfsense with a switch? The rules are not named.

18

Rules can, and for this integration should, have a description.

Edit: I see now that the github description mentions indeed “rule name”. I guess it refers to rule description.

“ * rule_filter ( Optional ): Used to create switches only on certain rules. Rule name must start with filter to match (ie. HomeAssisant-BlockTraffic1)”

19

@JeeCee Thx that make it clearer. I am still curious though and would like a response who someone that knows.

For all existing connection (with active states on the firewall), how are those states terminated as to prevent let’s say kids devices from connecting? I understand eventually the states will expire but it may be a while before that happens.

20

I’ve been struggling with implementing a rule switch using fauxapi, and I can’t for the life of me get it to work.

I just became aware of a new (unofficial) API implementation that is well documented and actively maintained (just out of beta): https://github.com/jaredhendrickson13/pfsense-api

Looks very promising. Has anyone else had a look yet?

21

Wow. That one looks quite powerful as well. Nice.

22

I’m using this API with great success, and enable/disable rules with a rest_command.

1 Like
23

I updated the code per fmagn’s code edits and I updated the SwitchEntity class to fix this error:

SwitchDevice is deprecated, modify pfSense to extend SwitchEntity

I put in a pull request @dgshue

24

You can’t just say, Hey, it works, and not give any details man!