Good morning all, I'm here to report a missing configuration from old outbound rules to new one. I know it's something that is my specific need/implementation but I put here some contest.
My ISP (Iliad Italia) uses MAP-E (not supported from OPNsense), but I use a trick and I connect the ISP router LAN ("router mode, no NAT") to the OPNSense WAN, then I know from ISP router GUI the port range (1:4) that is assigned to me (eg 24576:32767).
That range port was configured in the old outbound NAT, that allowed to set outbound interface WAN (with its IP address) AND the port range. The new Source NAT does not allow you to set the port range without choosing the TCP/UDP option, but - in this way - every protocol that is not TCP/UDP will not work (ICMP, etc...).
Now I have to roll back to old rules and all is working again.
Do you know if this can be implemented, or if I'm missing something?
Thanks a lot.
I don't understand, only UDP and TCP do have port numbers. ICMP has types. Other protocols don't have port numbers or use different schematics.
I guess the issue is that the new interface won't allow specifying a target port range when the protocol is "any", so I suppose you'd have to create one rule for TCP/UDP (with port range) and another rule for "any", and use sequence numbers to ensure that the TCP/UDP one comes first? Seems kindof unnecessarily cumbersome?
Curiously PF shows a port range even for ICMP-specific rules:
root@opntest1:~ # pfctl -s nat | grep icmp
nat on igc1 inet proto icmp from (igc0:network) to any -> (igc1:0) port 1024:65535
root@opntest1:~ #
Let's track this in an issue:
https://github.com/opnsense/core/issues/10504
Quote from: Monviech (Cedrik) on Today at 09:29:23 AMI don't understand, only UDP and TCP do have port numbers. ICMP has types. Other protocols don't have port numbers or use different schematics.
Yes, that's what I know too from the theory, but I think the old config works for a reason I don't know.
Quote from: dseven on Today at 10:18:12 AMI guess the issue is that the new interface won't allow specifying a target port range when the protocol is "any", so I suppose you'd have to create one rule for TCP/UDP (with port range) and another rule for "any", and use sequence numbers to ensure that the TCP/UDP one comes first? Seems kindof unnecessarily cumbersome?
Curiously PF shows a port range even for ICMP-specific rules:
root@opntest1:~ # pfctl -s nat | grep icmp
nat on igc1 inet proto icmp from (igc0:network) to any -> (igc1:0) port 1024:65535
root@opntest1:~ #
Exactly, now I'trying to, I just configured SNAT with two rules, one TCP/UDP with the specific ports and the other with the generic one below the first one, but it doesn't seem to work.
Do you know what the command is to reload the NAT rules? I'm not sure if they are reloaded when the settings are saved.