Winbox shows an address list that doesn't exists

leonset · Tue Jun 29, 2010 2:22 pm

Hi!

I have a problem in Winbox: in the Address List drop list box is showing an address list which doesn't exists. I have triple checked every rule in the firewall/nat/mangle tabs and that address list isn't used anywhere. I have even done a full export of the router configuration and there is no trace of that address list... Why is Winbox showing it?

Thanks!

bafh · Tue Jun 29, 2010 2:36 pm

Some possibilities come to mind. Some crazy bridge, made accidentaly after a litre of vodka. Or someone connected cable from WAN somewhere in LAN. Draw your network.

SurferTim · Tue Jun 29, 2010 2:41 pm

Is it the address list "winbox"? I noticed mine has those entries (even tho I use the api) without any firewall rules,

leonset · Tue Jun 29, 2010 2:46 pm

Hi!

No, it's an old address list that I was using in some firewall rules... but now I have changed them and created another address list.

Thanks!

SurferTim · Tue Jun 29, 2010 2:51 pm

When you had the old rule that added that list, did you set the "address-list-timeout" parameter? If not, the entry will be in the address list forever. Well, unless you manually remove it.

leonset · Tue Jun 29, 2010 3:15 pm

How should I remove the address list manually? The only way I know is to remove all IP's from it and if it isn't in use anymore it disappears automatically...

SurferTim · Tue Jun 29, 2010 3:24 pm

Replace X with line number of each entry you wish to remove:
/ip firewall address-list
print
remove X

leonset · Tue Jun 29, 2010 3:36 pm

And... What should I do if that address-list doesn't show up with /ip firewall address-list print ???

That's the problem I'm having

SurferTim · Tue Jun 29, 2010 3:40 pm

Wow! That is odd. What version of the OS and Winbox are you using? I don't use Winbox, but those that do will probably need that to help you.

If all else fails, generate a supout file and email it to support (at) mikrotik.com with a short explanation of the problem.

roadracer96 · Tue Jun 29, 2010 7:15 pm

If ANY rule ANYWHERE points to this list, it will show in the drop-down whether it exists or not.

fewi · Tue Jun 29, 2010 7:29 pm

And to find it it's probably easiest to save a "/export" and search for the address list name in a text editor. Something is referring to it somewhere.

SurferTim · Tue Jun 29, 2010 8:36 pm

If ANY rule ANYWHERE points to this list, it will show in the drop-down whether it exists or not.

Where does Winbox search for this list besides "/ip firewall address-list"? I am writing an API version and wish to maintain compatibility.

fewi · Tue Jun 29, 2010 8:53 pm

From the behavior I'm pretty sure it just parses the entire configuration for all references to address lists. So you'd have to look at every section that has configuration that can refer to address lists, get them all and compile your own list of lists.

I think that behavior is due to how dynamic address lists are now supported. For example, you can have a Hotspot user profile set up in a way that it adds the IP address of the client to an address list at login, and removes it at logout. Firewall, NAT and mangle rules should be able to select that address list name from a drop down, so it should show up - but if no client is logged in, the address list may have no members and may not show in "/ip firewall address-lists". Dynamic address lists can also be populated by at least RADIUS, PPPoE and DHCP servers, there may be more.

SurferTim · Tue Jun 29, 2010 9:05 pm

So much for compatibility. I'm not doing that.

roadracer96 · Tue Jun 29, 2010 10:00 pm

If ANY rule ANYWHERE points to this list, it will show in the drop-down whether it exists or not.
Where does Winbox search for this list besides "/ip firewall address-list"? I am writing an API version and wish to maintain compatibility.

Its not a bug or a problem. Every router I have out there has a drop with source-address-list=portscanners. But only sites that actually have been port-scanned have an address-list called port-scanners. When I go to choose another address list for a new rule, portscanners shows up because it is referenced in the config.

SurferTim · Tue Jun 29, 2010 10:16 pm

Thanks, roadracer96. I never thought it was a bug after your response. Then fewi backed it up. I can use a textbox rather than a drop-down. It's a Blackberry phone app. Not supposed to be complex, just portable!

leonset · Wed Jun 30, 2010 1:54 pm

And to find it it's probably easiest to save a "/export" and search for the address list name in a text editor. Something is referring to it somewhere.

I have done an export and there is no trace of those "ghost" address lists... so I don't know why WinBox is showing them up.

SurferTim · Wed Jun 30, 2010 2:00 pm

And to find it it's probably easiest to save a "/export" and search for the address list name in a text editor. Something is referring to it somewhere.
I have done an export and there is no trace of those "ghost" address lists... so I don't know why WinBox is showing them up.

In that light, I recommend creating a supout.rif file and email to support as I mentioned above. If you would please post their response here also. I am interested for my own selfish reasons.

changeip · Wed Jun 30, 2010 6:35 pm

i think winbox caches those results. close winbox, remove your winbox cache files, and then try again.

Chupaka · Sun Jul 04, 2010 2:24 am

just read the topic...

well, you can do the following test:

0) open WinBox or Terminal - works everywhere
1) create some firewall rule and set, for example, src-address-list=some_new_name
2a) in WinBox: look at Address Lists tab - empty "some_new_name" list is already here
2b) in Terminal: "/ip fi address-lists add list=<TAB>" - you will see "some_new_name" in possible completions
3) now, open the rule again and press "up" arrow right to the "Src. Address List" field (in Terminal - just unset it)
4) "some_new_name" list is still here (see 2)! but you cannot find that name in /export
5) (WinBox only - can't find a way to do it via Terminal) open the rule and press "down" arrow right to the "Src. Address List" field - it's already contains "some_new_name"! arrrgh! RouterOS is rancorous!

6) remove the rule and see, that "some_new_name" list disappeared =)

MT Staff, is there some way to completely unset the value?

leonset · Thu Jul 08, 2010 11:38 am

And... What if I have deleted the rule which had the address list name in use?

Even if I create another rule, add the old list, remove it... the old address list remains there!!

I've also tried to delete Winbox's cache and also accessing the router from other computers which had never used winbox before... no luck

Thu Jul 08, 2010 11:41 am

I just did the following:

1. Added a new address list with "name"
2. Added a new rule that uses address list "name"
3. Deleted this address list.
4. The rule still shows it uses the deleted address list!
5. As soon as I removed this rule, and added a new one - this address list is no longer available from the dropdown.

I couldn't repeat the issue

Chupaka · Thu Jul 08, 2010 12:33 pm

Even if I create another rule, add the old list, remove it... the old address list remains there!!

wrong. you must remove ALL rules which saved list name. if you create new rule and then remove it - some old rule still keeps the list name

Normis, will it be possible to completely unset some value without recreating the rule?

leonset · Thu Jul 08, 2010 1:31 pm

Even if I create another rule, add the old list, remove it... the old address list remains there!!
wrong. you must remove ALL rules which saved list name. if you create new rule and then remove it - some old rule still keeps the list name

I do... I have NO rule with that address list in them. I had them, but I modified the rule to point to a different address list. Then I supposed that just removing all the IP's that I had in the address list would be enough to delete it, but I'm without success.

Thanks!

Chupaka · Thu Jul 08, 2010 4:40 pm

I cannot reproduce this behaviour... seems like you have another rule that has remembered your old address-list...

Fri Jul 09, 2010 9:00 am

system reset -> add what's needed one by one

always helps

leonset · Fri Jul 09, 2010 9:25 am

I can't reset those systems and re-work them from scratch... that would be a lot of time, not to mention the downtime because my RB1000 units are in production. I may try to move all services to the second router and redo everything by hand in router1... but I don't like the idea

Thanks!

Chupaka · Fri Jul 09, 2010 2:55 pm

Normis, will it be possible to completely unset some value without recreating the rule?

leonset · Mon Jul 12, 2010 2:36 pm

Hi again,

Beside IP/Firewall, where may I be using address lists? I'm having this issue with some lists and not with others (I'm doing a lot of changes).

Thank you!

Chupaka · Mon Jul 12, 2010 3:40 pm

firewall only

fewi · Mon Jul 12, 2010 4:41 pm

There's a couple of other spots. Hotspots can refer to address lists, so could DHCP at one point. There may be more.

changeip · Mon Jul 12, 2010 7:33 pm

run an '/export file=config' and then search it with notepad for names.

leonset · Tue Jul 13, 2010 10:21 am

run an '/export file=config' and then search it with notepad for names.

The problem is that the address list doesn't show up in export but still shows up in Winbox. In fact, yesterday I did an export of ip-firewall, restored it to another, brand new unit, and the address list didn't show in winbox! This is driving me crazy!

Chupaka · Tue Jul 13, 2010 3:42 pm

as it was said, if you re-create your rules - those address lists will disappear. so you may create (via Import) the copy of your rules under the main rule set, and then remove original rules

p.s. I wonder, whether 'backup' saves those unset values...

leonset · Tue Jul 13, 2010 3:46 pm

If an export-import solves the problem, RouterOS or Winbox is storing those address list values somewhere else than just the usual places available for user edit.

I don't like the idea, but I will do an export/import in my main firewall and check the results.

Thanks,

ManyX · Fri Oct 22, 2010 11:17 am

I have the some problem I can't remove address-lists from winbox from upper right menu.
I don't have any rules in firewall with this address-lists and don't have this rule in address-list in winbox or in console /ip firewall address-list print.

How should I remove this?

Chupaka · Sat Oct 23, 2010 3:21 am

reconfigure your router from scratch - it will work for sure

ManyX · Sun Oct 24, 2010 10:28 pm

it works but I must write about 100 line with my configuration by hand.

It is a bug in ROS ?

Chupaka · Mon Oct 25, 2010 1:51 am

I must write about 100 line with my configuration by hand.

something like

/ip firewall mangle
export file=mangle.rsc
remove [find]
import mangle.rsc

do it for

/ip firewall
mangle
.. filter
.. nat
/queue
simple
.. tree

It is a bug in ROS ?

it's a 'feature' - WinBox remembers much more than CLI shows...

leonset · Mon Oct 25, 2010 10:11 am

Hi,

If WinBox "remembers" something that is NOT in a given RouterOS instance it isn't a "feature" but a bug, because you can't get consistency among what you see and what's currently running in RouterOS.

On the other hand, if Winbox has "memory" to "remember" such things there has to be a way to delete that memory and force Winbox to reload all settings for a given RouterOS from scratch... Do someone knows where may it be?

Regards

dssmiktik · Tue Oct 26, 2010 6:37 am

A couple things to note:

I've seen this issue if ANY firewall rule IS/WAS set at one point and time with that address-list. Basically, each rule "remembers" some of it's previous settings (i think related to undo feature). If you remove ALL rules that EVER had that address list, then the list will be completely removed.

Also, I've seen cases where you can try to change 2 or more settings in a firewall rule, and the rule won't apply because it "remembers" it's previous settings. This only happens in winbox (as far as i can tell).

bburley · Sun Feb 06, 2011 5:54 am

I now have the same problem with two address lists in v4.11 (RB750G). I have been working on it for hours with no solution.

I did discover that some rules would retain an address-list entry even though the address-list box was "closed up". I opened the address-list box again, the address-list name reappeared. I saved the rule with the box "open" and the entry erased, just leaving whitespace in the box. That entry no longer appeared in the box.

My two phantom address-list names are still there.

I went through all of the rules and saved each one with whitespace showing in the address-list fields.

My two phantom address-list names are still there.

I exported the entire config, and those phantom names were not present in the exported file.

I removed all firewall rules, address-lists, and other firewall entries, and they are still there even before re-importing.

Is netinstall the only solution?

Who is online