Missing options in Firewall Automation Filters

[matgel-is-unavailable]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Is your feature request related to a problem? Please describe.

For the purpose of automating firewall rules via the API, we are missing the option to use firewall aliases of type "port" in the automation rules. Additionally, we lack the ability to allow both TCP and UDP in the same rule (TCP/UDP); currently, it is only possible to allow either TCP or UDP, not both.

The same limitation applies to IPv4 & IPv6, although this one is less critical for us.

Describe the solution you like

1. Add support for firewall aliases of type "service" under Destination Port
2. Add support for option (TCP/UDP) under Protocol
3. Add support for option (IPv4+IPv6) under TCP/IP Version

Describe alternatives you considered

The only alternative to using automation rules is to split each firewall rule into multiple automation rules, specifying the required ports and either UDP or TCP. This approach would create significant overhead.

Additional context

[AdSchellevis]

I'm pretty sure port aliases are allowed in these fields:

core/src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml

Line 84 in 7e60e9f

<EnableAlias>Y</EnableAlias>

Implemented over a year ago (opnsense/plugins#3567)

[matgel-is-unavailable]

@AdSchellevis, my apologies; I should have mentioned that we are currently using the business edition, version 24.4.3. I did not check the community edition.

Will this feature be available in the business edition as well? And what about the TCP/UDP option?

Thank you for your help.

[AdSchellevis]

@matgel-is-unavailable no problem, but I expect 24.4.3 also supports (valid) alias input to be honest. The change doesn't seem very recent on our end. I don't mind offering the combined rules for [ip]proto, it's just not very high on my list of things to do at the moment (you can still create the same rules, it just needs more of them).