Skip to main content

PFS104 - pfSense Host Alias Cannot Hold a Network

Agent error code #PFS104 indicates that a grant carried a whole network as its source (a predefined source configured as a CIDR range, not a single address), but the pfSense alias this Knoc manages is typed Host(s). A host alias can only hold single IP addresses and FQDNs, so the agent refuses the grant rather than adding one address from the network and reporting success while the rest of the range stays blocked.

This error is distinct from an alias that cannot be edited at all (#PFS102). Error #PFS104 means the edit would succeed, but the result would misrepresent what was actually granted.

Common causes include:

  • The Knoc's predefined sources include a network range, but the alias configured for it on pfSense was created as Host(s)
  • An alias that previously only ever received single-address grants was switched, on the Knoc side, to also serve a knoc with network sources

Steps to Resolve

Change the Alias to a Network Alias

  1. Log into pfSense and navigate to Firewall > Aliases > IP
  2. Open the alias named in the Knocknoc ACL
  3. Change Type from Host(s) to Network(s)
  4. Click Save and Apply Changes

A Network(s) alias also accepts single addresses (as a /32), so this change is safe even if the same alias is shared with knocs that only ever grant single addresses.

Or Point the Knoc at a Different Alias

If the existing host alias is relied on elsewhere and should not change type, edit the Knoc's ACL configuration and set Alias name to a different alias that is already typed Network(s) (or an empty one Knocknoc can create fresh, since a new alias is created as a network alias automatically when its first grant is a network).

Still Having Issues?

We can help you out, contact us at [email protected].