Hi.
Just upgraded a small OPNSense setup from 25.7.11 to 26.1. It went well, including the migration of rules to the new system (although this was a very simple setup, and I'm a bit worried about my bigger production system which has thousands of rules, in a HA pair of OPNSense ...)
One thing I wonder now with the new rules interfaces, is the difference between NAT -> Source NAT and NAT -> Outbound (as the later is obviously a Source NAT too). Could someone clarify ? Will a later migration process be needed to migrate Outbound rules to Source NAT ? Or will this just be a manual process ?
https://docs.opnsense.org/manual/nat.html#source-nat
It's not finished yet, Outbound NAT is still the main page. About plans and possible migration, we don't know yet, it might be a roadmap item for a new release.
I don't see a "static port" option on the new Source NAT interface (maybe that's one of the TBD items) but can I assume that source port randomization is still done by default?
I'm currently using the Hybrid mode and tempted to try and migrate some manual rules from the Outbound UI but leave the automatic rules in place, and change it back to Automatic mode. Bad idea at this time?
Quote from: OPNenthu on February 12, 2026, 04:43:43 AMI don't see a "static port" option on the new Source NAT interface
I was wondering the same. There is the 'Translate Source Port' field. Maybe setting this to the same port/alias as 'Source port', equates to static port mapping?
I was literally looking at this right now.
I migrated most of my "Outbound" NAT rules to "Source NAT" but also noticed the missing "Static-port" option.
I saw a post by franco saying that Outbound NAT will become legacy, so thought I'd jump the gun, but the static-port option remains a bit of a mystery in Source NAT
I noticed it was added a couple weeks ago: https://github.com/opnsense/core/issues/9928
Oooooh nice.
Would be great to see this in a 26.1.x release :)
Will be in 26.1.5.
Cheers,
Franco
Quote from: franco on March 23, 2026, 05:05:23 PMWill be in 26.1.5.
Cheers,
Franco
Thanks Franco..... that's brilliant
Dear Franco,
I noticed that the invert exclamation mark is not showing in the destination address in Source NAT.
I apologize if this has already been discussed. If not, this needs to be fixed in future releases.
I use the version 26.1.5.
Thank you for your work.
Hi and thanks for the hint. I made a note here: https://github.com/opnsense/core/issues/9515#issuecomment-4205865737
Cheers,
Franco
Just a small question:
With 26.4.1 (be) it is not possible to choose the Translation IP from the virtual IPs in The "new" UI!
Atm we rely heavy on this "feature" in the outbound section. Will this be added?
Thanks, and regards.
Stefan
Hi Stephan,
You're right. We're talking about it right now.
Outbound -> Source NAT is not entirely ready yet. Likely for a later 26.7.x and 26.10.
Cheers,
Franco
I also have a question OPNsense 26.1.11_6-amd64
I see under outbound hybrid ( legacy rules ), automatic rules including the below sources ( which is correct )
LAN networks, LAN_VL4 networks, LAN_VL23 networks, Loopback networks, au761nordvpncom networks, us9417nordvpncom networks, 127.0.0.0/8
I've upgraded to OPNsense 26.1.11_6-amd64, and run the migration wizard, on see the below SNAT automatic rules, which seems to be missing LAN networks, au761nordvpncom networks, us9417nordvpncom networks
Loopback network, LAN_VL4 network, LAN_VL23 network
LAN side Interfaces are;
LAN
LAN_VL4
LAN_VL23
Automatic rule generation is enabled
OPNsense is not handling VLAN tagging, ESXi vswitch handles all vlan tagging, and interfaces are presented as untagged interfaces to OPNsense VM
The old outbound page basically went to ifconfig to gather networks to NAT just for showing these networks in the GUI. The source NAT page doesn't do this so some of the networks that are being natted are missing from the list there, but the NAT rules are in effect. We're discussing how to change the visibility.
Cheers,
Franco
Quote from: franco on July 08, 2026, 04:10:33 PMHi Stephan,
You're right. We're talking about it right now.
Outbound -> Source NAT is not entirely ready yet. Likely for a later 26.7.x and 26.10.
Cheers,
Franco
Thanks for your information, so waiting for one of the next releases before migrating to "new" Source NAT.
Sorry for the typo, I meant 'Stefan' of course
Quote from: hharry on July 09, 2026, 04:09:44 AMI also have a question OPNsense 26.1.11_6-amd64
I see under outbound hybrid ( legacy rules ), automatic rules including the below sources ( which is correct )
LAN networks, LAN_VL4 networks, LAN_VL23 networks, Loopback networks, au761nordvpncom networks, us9417nordvpncom networks, 127.0.0.0/8
I've upgraded to OPNsense 26.1.11_6-amd64, and run the migration wizard, on see the below SNAT automatic rules, which seems to be missing LAN networks, au761nordvpncom networks, us9417nordvpncom networks
Loopback network, LAN_VL4 network, LAN_VL23 network
LAN side Interfaces are;
LAN
LAN_VL4
LAN_VL23
Automatic rule generation is enabled
OPNsense is not handling VLAN tagging, ESXi vswitch handles all vlan tagging, and interfaces are presented as untagged interfaces to OPNsense VM
I realise the new SNAT section is work in progress. However I was surprised to see in @hharry's screenshot, some automatic NAT rules nicely grouped & displayed. My local interfaces are also non-VLAN, vtnet based in a VM. After seeing that screenshot was from 26.1.11_6, I was expecting to see something, but I none of the auto NAT rules are listed. FWIW I entered my SNAT rules manually earlier, prior to deleting them from NAT->Outbound, and I have hybrid mode enabled. All expected nat entries appear to be present under firewall diagnostics.
Yes, there is a migration tool. As far as capabilities go outbound and source NAT shall be identical and the switch is mainly made to enable MVC/API access to that component. Outbound NAT will eventually move to the os-firewall-legacy plugin as well.
Cheers,
Franco
Quote from: franco on July 09, 2026, 04:38:40 PMYes, there is a migration tool. As far as capabilities go outbound and source NAT shall be identical and the switch is mainly made to enable MVC/API access to that component. Outbound NAT will eventually move to the os-firewall-legacy plugin as well.
Thanks @franco. I redefined my outbound rules under SNAT manually a while back and did not see or use the tool.
In order for auto NAT rules to be listed under the new SNAT interface (as per hharry's screenshot), do we need to run the tool? I cannot find it. I even added a temporary rule under old Outbound interface, in case this was needed to trigger the visibility of the tool.
Auto-NAT rule are shared between both components, but don't show entirely on the source NAT page yet but they are in effect (the code for this did not change).
The migration tool was added in 26.1.11 so very recently.
Cheers,
Franco
@franco Sorry I was slow catching on. I attributed auto-generated rules not appearing as an artifact of having not used the migration tool. Instead I have a PPPoE WAN so am likely affected by #10479 (https://github.com/opnsense/core/issues/10479) as you have pointed out earlier.
Just used the migration assistant to move Outbound to Source NAT, seems to have worked!
It did take me I think a little too long to realized the check mark that shows up is the 'activate/go' button, but that's I believe a me problem.
Quote from: jonny5 on July 22, 2026, 07:15:24 PMIt did take me I think a little too long to realized the check mark that shows up is the 'activate/go' button, but that's I believe a me problem.
You are not alone! ;)
There are more places where it should be converted to a regular button, but for now it seems to be a low priority thing...