OPNsense Forum

English Forums => Development and Code Review => Topic started by: patient0 on December 03, 2025, 08:35:25 AM

Title: Delete one firewall rule on WAN/LAN/TEST -> All firewall rules gone
Post by: patient0 on December 03, 2025, 08:35:25 AM
Good Morning,

On a OPNsense lab instance, I'm on latest DEV 26.1.a_621-amd64 and created a rule on WAN for ping. Afterwards I deleted that rule and boom, all firewall rules were gone, on all interfaces. That was ... surprising :). The firewall rules were created in the standard 'Rules', not 'Rules [new]'

That instance runs on Proxmox (which runs on a Hetzner root server) and has three virtual interfaces and Tayga: WAN (vtnet0), LAN (vtnet1), TEST (vtnet2) & Tayga.

If I delete one/any rule on WAN, LAN or TEST, all firewall rules on all four interfaces disappear in the GUI (also on Tayga). On interface Tayga deleting a rule does work normally.

In the config file the rules are present and do work, would indicate a GUI issue.

Is that something anyone else encountered? I can share the working and non-working config.

Adding, modifing, enabling/disabling rules does also work correctly.
Title: Re: Delete one firewall rule on WAN/LAN/TEST -> All firewall rules gone
Post by: patient0 on December 03, 2025, 09:07:41 AM
Answering myself: After diff-ing the two configs, there is an extra <rule> ... </rule> in the config file.

Right after </nat><filter> there is the wrongly added '<rule>' and before <scrubs> is the surplus closing </rule>.
Manually removing these two lines made the rules appear again in the GUI.
Title: Re: Delete one firewall rule on WAN/LAN/TEST -> All firewall rules gone
Post by: Monviech (Cedrik) on December 03, 2025, 10:11:30 AM
Do you already have "Destination NAT" instead of "Port Forward" under NAT?

Thats a thing that changed recently, maybe there's something unexpected going on?

https://github.com/opnsense/core/commit/da976d77fb46117b3837693b43b4b34472fd19f8
Title: Re: Delete one firewall rule on WAN/LAN/TEST -> All firewall rules gone
Post by: patient0 on December 03, 2025, 10:23:12 AM
Quote from: Monviech (Cedrik) on Today at 10:11:30 AMDo you already have "Destination NAT" instead of "Port Forward" under NAT?
No, it is still called 'Port Forward', of which I have two + an Outbound NAT for IPv6.

Addition: Deleting one of the port forward rules make them all (two) disappear). In that use case there is again a <rule>...</rule> added. <rule> after </outbound> and </rule> before </nat>. Removing them resolves it.