Query to trigger on "Alias" name and then delete all its open states

[HovKlan-DH]

I have some troubles understanding exactly how the advanced query works, and if my use-case is even possible, so if I depict my goal here, then hopefully someone could give some hints if this is possible.

I have defined some aliases - e.g. MiscDevices which hold a number of hosts IP addresses. In the firewall rules I have a rule where I allow/disallow these misc. devices, and now I ideally want to clear the active states for this alias, when I am closing the firewall for these - to stop its communication.

Here-and-now I have implemented that it will clear ALL states for my (wireless) interface, where these hosts are present. It works and looks like this:

<?PHP

# URL for the pfSense API endpoint
$url = "https://10.0.0.1/api/v2/firewall/states";

# API key
$api_key = "67234jhgsdf23452jhefsdgf2346gdrg";

# Data to be sent in the request
$data = array(
    "limit" => 0, // 0=all
    "interface" => "mvneta0.20", // wireless
);

# Initialize a cURL session
$ch = curl_init();

# Setup cURL options
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // ignore SSL certificate validation
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // ignore SSL host verification
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "DELETE");
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    "Content-Type: application/json",
    "x-api-key: $api_key",
));

# Execute the cURL session and get the response
$response = curl_exec($ch);

# Check for cURL errors
if (curl_errno($ch)) {
    echo "cURL error: ".curl_error($ch);
    exit();
} else {
    # Decode the JSON response
    $response_data = json_decode($response, true);
    echo "<pre>";
    print_r($response_data);
    echo "</pre>";
}

# Close the cURL session
curl_close($ch);

?>

The disadvantage is of course that it clears ALL states, which could give some glitches for others, so ideally I want to only target/clear the specific hosts within the alias MiscDevice - so my question is now - is this possible? 😁

[jaredhendrickson13]

It's not possible with a single call to DELETE /api/v2/firewall/states. pfSense does not keep track of the alias in the firewall state so there is not a field that can be queried for that there. However, you could add some extra logic to your code achieve a similar result:

1. Make a request to GET /api/v2/firewall/aliases to fetch the alias you're looking for
2. In your code, iterate over the items in the address field of the aliases response data. This should be a list of IPs.
3. For each item in the array, and depending on the direction of the traffic you're looking for, make a request to DELETE /api/v2/firewall/states?source__startswith=<IP from the alias's address list> and/or DELETE /api/v2/firewall/states?destination__startswith=<IP from the alias's address list>

This will effectively delete any existing states with the IPs set in the alias. However, this would only work if the items in the alias are actual IPs, not hostnames.

[HovKlan-DH]

You are of course right, and I didn't consider this approach. Thanks a lot (as usual) 👍