OPNsense Forum

Archive => 24.1, 24.4 Legacy Series => Topic started by: RoamingJay on March 17, 2024, 05:16:32 AM

Title: Possible to choose multiple networks in the Source Address field?
Post by: RoamingJay on March 17, 2024, 05:16:32 AM
Firewall has multiple public IP addresses, and running VPN.
Trying to do manual or hybrid outbound NAT to specify a dedicated WAN for a group of clients.

Then realized the Source Address field doesn't allow choosing multiple items (something like pressing Shift key)..
Any way to select multiple networks like the auto-generated rule does, or perhaps 1 network per rule with multiple outbound rules?

Currently using policy rounding to kind of specifies the outbound WAN, kinda works for now.
Title: Re: Possible to choose multiple networks in the Source Address field?
Post by: Monviech (Cedrik) on March 17, 2024, 05:24:36 AM
Create an Alias with multiple clients and choose the Alias in the Source.
Title: Re: Possible to choose multiple networks in the Source Address field?
Post by: RoamingJay on March 17, 2024, 05:58:06 AM
Yup, this should do the job.
Was wondering if there is any hidden toggle to enable multiple-selection.
Anyway, thanks for the quick reply
Title: Re: Possible to choose multiple networks in the Source Address field?
Post by: RoamingJay on March 17, 2024, 06:05:52 AM
Quote from: Monviech on March 17, 2024, 05:24:36 AM
Create an Alias with multiple clients and choose the Alias in the Source.

New question, with Alias, Type - Network Group, how to include the firewall itself the 127.0.0.0/8 address?
Title: Re: Possible to choose multiple networks in the Source Address field?
Post by: Monviech (Cedrik) on March 17, 2024, 07:08:20 AM
There is a standard Alias in the Firewall rules for that, called "This Firewall".
Title: Re: Possible to choose multiple networks in the Source Address field?
Post by: RoamingJay on March 18, 2024, 07:11:35 AM
The "This Firewall" isn't really a network so it's not present in the Content of Network Group. Could first create an Alias containing "This Firewall" then it will show up in the Content  :-\

Might be a mess to mange down the road, so decided to just stick with policy rounding to select the specific gateway/WAN-port instead of using the Default Gateway. With the "Allow default gateway switching" disabled, this method seems to work just fine.