Manual rules in "Firewall->NAT->Source NAT" went missing post upgrade.
26.1.10:
26.1.10-SNAT.png
root@firewall:~ # cat /tmp/rules.debug| grep Outbound
nat on wg1 inet from (IG_OUT_VPN:network) to any -> (wg1:0) port 1024:65535 # Outbound NAT on WAN_VPN1
nat on wg1 inet6 from (IG_OUT_VPN:network) to any -> (wg1:0) port 1024:65535 # Outbound NAT on WAN_VPN1 (IPv6)
nat on wg2 inet from (IG_OUT_VPN:network) to any -> (wg2:0) port 1024:65535 # Outbound NAT on WAN_VPN2
nat on wg2 inet6 from (IG_OUT_VPN:network) to any -> (wg2:0) port 1024:65535 # Outbound NAT on WAN_VPN2 (IPv6)
nat on igc1 inet6 from $WAN_WARRIORS to any -> (igc1:0) port 1024:65535 # Outbound NAT on WAN for WAN_WARRIORS (IPv6)
26.1.11:
26.1.11-SNAT.png
root@firewall:~ # cat /tmp/rules.debug| grep Outbound
root@firewall:~ #
Revert to 26.1.10 snapshot restores them.
You have Automatic NAT rule generation enabled. You should turn this to manual or hybrid.
That setting isnt new its the same as in Outbound NAT.
I have yet to migrate the legacy outbound NAT rules to the new SNAT UI and I'm a bit confused about it. I thought there would be a migration process for those but it shouldn't affect anything that I created manually in the new UI? Have they been merged?
The Outbound NAT mode affects both the old Outbound NAT rules and the new SNAT rules.
There was an issue here for quite a while that SNAT rules didnt take the global Outbound Rule mode into consideration and always rendered into the ruleset regardless.
https://github.com/opnsense/core/pull/10472
If you used both GUIs at the same time with different intentions, thats not going to work anymore. Both GUIs adhere to the same Mode now.
TLDR set your mode to hybrid if you need both automatic and manual rules at the same time.
@OPNenthu you need to consider that the UI is the UI and the pf filtering and NAT mechanism is running a couple of layers lower down the stack.
So all rules you create in the legacy (outbound) UI will eventually end up in the kernel and all rules you create in the new (source NAT) UI will just as well end up in the kernel. No idea about the order, but in case of NAT it's not quite as critical as with firewall rules.
Think of two admins both managing a set of rules.
Your task is to review the legacy rules, then one by one create an equivalent one in the source NAT UI, delete the one in the legacy UI, rinse and repeat. The state in the kernel's pf rules will more or less (not considering order) be the same.
HTH,
Patrick
Well you dont have to manually migrate them one by one, we enhanced the Firewall Migration assistant to include a download for Outbound NAT rules.
And /all/ NAT rule pages now also have CSV upload and download (you're welcome :))
Quote from: Patrick M. Hausen on July 01, 2026, 08:44:37 PMNo idea about the order, [...]
I don't know how they end up in the kernel (good point), but at least in the /tmp/rules.debug file I have seen that the SNAT UI rules take precedence over the outbound NAT rules with different priorities. For that reason I was putting off migration of the legacy NAT rules until I understood the process better, but it sounds like I created a problem by not changing the mode.
# [prio: 50]
nat on wg1 inet from (IG_OUT_VPN:network) to any -> (wg1:0) port 1024:65535 # Outbound NAT on WAN_VPN1
nat on wg1 inet6 from (IG_OUT_VPN:network) to any -> (wg1:0) port 1024:65535 # Outbound NAT on WAN_VPN1 (IPv6)
nat on wg2 inet from (IG_OUT_VPN:network) to any -> (wg2:0) port 1024:65535 # Outbound NAT on WAN_VPN2
nat on wg2 inet6 from (IG_OUT_VPN:network) to any -> (wg2:0) port 1024:65535 # Outbound NAT on WAN_VPN2 (IPv6)
nat on igc1 inet6 from $WAN_WARRIORS to any -> (igc1:0) port 1024:65535 # Outbound NAT on WAN for WAN_WARRIORS (IPv6)
binat log on igc1 inet6 from <redacted>::/61 -> (lo1:0)/61
# [prio: 200]
nat on igc1 inet from (vlan0.1030:network) to any port 500 -> (igc1:0) static-port # Automatic outbound rule
nat on igc1 inet from (vlan0.1040:network) to any port 500 -> (igc1:0) static-port # Automatic outbound rule
nat on igc1 inet from (vlan0.1050:network) to any port 500 -> (igc1:0) static-port # Automatic outbound rule
nat on igc1 inet from (vlan0.1060:network) to any port 500 -> (igc1:0) static-port # Automatic outbound rule
... etc
Thanks, both. Let me try to clean this up...
For the record I think this is about https://github.com/opnsense/core/commit/6f3b49f6811 which we discussed and also noted in the release notes.
Conceptually the whole outbound mode switcheroo is a bit over-engineered, but for the sake of consistency it now adheres to the setting for source NAT behaviour as well so that it is a direct replacement for outbound NAT. Eventually, just being able to switch automatic rules on/off and always showing in hybrid mode is probably the best thing to do in the long term, but not before the old component is being completely removed (post its plugin live starting in 27.1).
Cheers,
Franco
Quote from: Monviech (Cedrik) on July 01, 2026, 08:50:35 PMAnd /all/ NAT rule pages now also have CSV upload and download (you're welcome :))
Are you sure? :)
I changed the Outbound NAT mode to Hybrid and upgraded again to 26.1.11. For one thing, I'm not seeing an option to download the Outbound NAT rules as CSV. Even the Migration Assistant UI is empty.
Outbound NAT.webp
Migration Assistant.webp
I also see some weirdness with regard to WG interfaces. You'll notice in the Outbound NAT UI there are auto generated rules for e.g. WAN_VPN1, WAN_VPN2. Those do not appear at all in the automatically generated rules list under the SNAT UI. I only see the rules for the normal (non-WG) interfaces:
SNAT.webp
I might need a little bit of hand holding. I can create the WG/VPN rules manually, no problem. Do I need to manually migrate the rules for all other interfaces as Patrick suggested (one by one)? What do I do about the ISAKMP ones?
Sorry if I'm being a dunce here.
EDIT: I had deleted the manual SNAT rules before the upgrade, btw. That's not a bug.
Marking as solved because I got my manual rules added back and everything's working, but I'm still not sure why some of the automatic rules aren't reflected in the SNAT UI. Going to leave the automatic rules alone for now.
Thanks all!
PPP-related rules may not show up yet in the source NAT GUI but automatic rules were not touched by the change so it's a cosmetic thing:
https://github.com/opnsense/core/issues/10479
Cheers,
Franco
Thanks for the link. Re-reading the release notes and also the submitter's comments in that ticket, it sounds like there should have been a SNAT migration option but I am missing it. Did I overlook something or is there a way I can get it back, so that I can migrate the rest of them (the automatic ones)?
You can only migrate outbound NAT manual(or "hybrid") rules. You don't seem to have any. There's nothing to migrate. Automatic rules are automatic and come from the same place for both components just for visibility.
Cheers,
Franco
Am I right in thinking, after upgrading to 26.1.11, we should switch back to hybrid mode under Outbound NAT?
I had turned this off following migration of my rules to SNAT as I had noticed SNAT rules got generated regardless of the selected mode.
EDIT: I just upgraded and see the mode option also appears on the SNAT page, and is in sync with selection in legacy Outbound page. So question answered.
Quote from: keeka on July 02, 2026, 07:46:32 AMAm I right in thinking, after upgrading to 26.1.11, we should switch back to hybrid mode under Outbound NAT?
I had turned this off following migration of my rules to SNAT as I had noticed SNAT rules got generated regardless of the selected mode.
EDIT: I just upgraded and see the mode option also appears on the SNAT page, and is in sync with selection in legacy Outbound page. So question answered.
So what did you leave it on? Mine is on Automatic after I migrated to SNAT.
Should I change this to Hybrid or manual or leave it as is?
If you have manual rules to migrate then you will set hybrid or manual, but that is already set for your use case.
If you don't have manual rules nothing needs to be migrated.
Cheers,
Franco
Quote from: franco on July 02, 2026, 10:43:29 AMIf you have manual rules to migrate then you will set hybrid or manual, but that is already set for your use case.
If you don't have manual rules nothing needs to be migrated.
Cheers,
Franco
Sorry Franco.....
I *already* migrated my rules from Outbound NAT to SNAT (At which point Outbound NAT was set to Hybrid)
Once I migrated them to SNAT, I changed outbound NAT back to Automatic.
Is this what I should be doing, or should I change Outbound NAT to something else before upgrading?
EDIT: Figured it out. Set it back to Hybrid after reading the release notes properly :)
Quote from: Patrick M. Hausen on July 01, 2026, 08:44:37 PMThink of two admins both managing a set of rules.
Quote from: franco on July 02, 2026, 07:34:59 AMYou can only migrate outbound NAT manual(or "hybrid") rules. You don't seem to have any. There's nothing to migrate. Automatic rules are automatic and come from the same place for both components just for visibility.
Ironically, this is what Patrick was telling me but it didn't fully click last night.
I do have manual rules actually, but I guess the migration option might have been hidden from me because my Outbound NAT rules were still set to Automatic before I upgraded. I should have reverted the upgrade, then changed to hybrid, then upgraded again. Instead I reverted, changed to hybrid, for some reason deleted the manual rules (mistake), then upgraded and manually re-entered them.
Apparently sleep does wonders for comprehension :)
Thanks again
EDIT: oh, and I already had the manual rules in the new SNAT UI to begin with. Not sure what I expected. 🤦
Quote from: franco on July 02, 2026, 07:34:59 AMYou can only migrate outbound NAT manual(or "hybrid") rules.
So if you have only a few then you might as well re-create them and delete the old ones ?
QuoteAutomatic rules are automatic and come from the same place for both components just for visibility.
I will double check if this is the case before I start, because I had Hybrid NAT Mode Enabled long before the new Source NAT section was added to OPNsense and when I checked after it was added I can't remember seeing anything there to be honest...
And just some quick checks about what the
26.1.11 Release Notes mentioned :
QuoteNote that this update brings the outbound to source NAT migration page, but it is only a formality as outbound NAT will stay in 26.7
Does this basically mean that the same "Grace period" that started for the Firewall Rules when 26.1 was released now apply to Outbound NAT and that it will probably be moved to a plug-in starting with 27.1 next year ?
Quotealthough the legacy firewall rules page will move to a plugin during the major upgrade. It is the same process that was employed with ISC-DHCP.
Does this mean that in order to avoid messing around with a plug-in for the Firewall Rules it would be smarter to migrate them to Firewall Rules (New) before the 26.7 upgrade ?
I have done the same when this was announced for ISC-DHCP and moved to KEA before upgrading to 26.x to avoid potential "Core functionality moving to a plug-in issues" that eventually turned out to effect some people who had not done the same, so I would like to do this again for the Firewall Rules now :)
QuoteDue to this addition, however, the source NAT rules entered in the system will no longer work unless the mode is set to either "manual" or "hybrid".
Does that setting sync between Outbound NAT and Source NAT or do you have to confirm both just to be sure nothing goes wrong ?
I will check it myself ofcourse, but I am curious about how it was designed to work so I can report back if anything turns out to be different than expected...
Quote from: Monviech (Cedrik) on July 01, 2026, 08:50:35 PMAnd /all/ NAT rule pages now also have CSV upload and download (you're welcome :))
I would hereby like to thank the OPNsense Team for their .CSV files addiction that makes Importing/Exporting Data and/or Settings of all the sub-sections that have this option
SUPER EASY !!! :)
I use hybrid mode. The Automatically generated rules in SNAT are less then in NAT: Outbound. For me, it looks like, wg0 networks and 127.0.0.0/8 are missing.
Also static port is not shown in the summary/has no column.
Edit: Interesting, according to the docs, Step 4(b) - Create an outbound NAT rule (https://docs.opnsense.org/manual/how-tos/wireguard-client.html#step-4-b-create-an-outbound-nat-rule), you have to add this manually for WireGuard. Still, for me it was in automatic in outbound and isn't in SNAT (visible).
> Does this basically mean that the same "Grace period" that started for the Firewall Rules when 26.1 was released now apply to Outbound NAT and that it will probably be moved to a plug-in starting with 27.1 next year ?
Yes.
> Does this mean that in order to avoid messing around with a plug-in for the Firewall Rules it would be smarter to migrate them to Firewall Rules (New) before the 26.7 upgrade ?
It doesn't matter. Nothing can go wrong except losing the immediate ability to edit the legacy rules if the plugin is MIA for whatever reason. The rules are still registered and rendered by the backend.
What we can achieve with 26.7, however is to switch rules [new] to rules and rules to rules [legacy] for clarity and that legacy rules can be removed from the system and menu via plugin drop (and actually not being required at all for 26.7 factory defaults).
> I have done the same when this was announced for ISC-DHCP and moved to KEA before upgrading to 26.x to avoid potential "Core functionality moving to a plug-in issues" that eventually turned out to effect some people who had not done the same, so I would like to do this again for the Firewall Rules now :)
Due to the degree of integration and early coding ideas every change away from code that is almost 20 years old is difficult for different reasons. I don't expect the same challenges, but there may be others.
> Does that setting sync between Outbound NAT and Source NAT or do you have to confirm both just to be sure nothing goes wrong ?
Yes, it is the same setting underneath so that source NAT is a full replacement of outbound NAT without behavioural changes. Later we want to change that, but likely not before oubound NAT within a plugin is leaving forever (28, 29?)
> I would hereby like to thank the OPNsense Team for their .CSV files addiction that makes Importing/Exporting Data and/or Settings of all the sub-sections that have this option SUPER EASY !!! :)
Thanks, it seems to be a practical addition for a number of reasons. This pattern will likely continue. :)
Cheers,
Franco
Quote from: franco on July 02, 2026, 07:40:23 PMWhat we can achieve with 26.7, however is to switch rules [new] to rules and rules to rules [legacy] for clarity and that legacy rules can be removed from the system and menu via plugin drop (and actually not being required at all for 26.7 factory defaults).
I am now ready for that change : Firewall Rules succesfully migrated to Firewall Rules [New] :)
QuoteThanks, it seems to be a practical addition for a number of reasons. This pattern will likely continue. :)
SWEET! :)
I like having small backups of certain sub-sections of my Router/Server and so on...