I've just installed OPNsense 26.7 on a Sophos XG210 and the installation ran fine.
I assigned:
igb0 -> WAN
ibg1 -> LAN
I set the IP address on the LAN to 10.100.1.1/24 and logged in to the UI, set dark mode, ran the setup wizard and set the WAN address to IPv4 static 77.**.**.55/28 and it worked. The wizard completes successfully. DNSmasq is configured as a DHCP server.
A laptop connected to the LAN interface (wired Ethernet) obtains an IPv4 address via DHCP and can ping 10.100.1.1.
Going on the VGA console and starting a shell I can ping 1.1.1.1 and 9.9.9.9 okay.
Under Firewall > Rules the deault rule "Default allow LAN to any rule" is present.
Under Firewall > NAT > Source NAT > Automatic Source NAT Rule Generation shows no rules. Changing to hybrid and adding a Source NAT rule for "LAN Address" to Any with Source NAT to WAN interface address adds the rule to the table but the laptop on the inside still cannot ping my default gateway or 1.1.1.1 or 9.9.9.9.
Am I missing something? I thought that OPNsense given just two interfaces automatically built the NAT from LAN -> WAN without any additional configuration and it worked "out of the box"?
Mike
Do you have an ICMP LAN allow firewall rule? Source LAN Network -> Anywhere
Quote from: miketubby on July 20, 2026, 04:09:52 PMran the setup wizard and set the WAN address to IPv4 static 77.**.**.55/28
If you set the WAN as static you have to manually set/choose the gateway in the interface settings. Setting a gateway makes it a WAN connection (for the system) and then the NAT rules are created automagically.
Quote from: axsdenied on July 20, 2026, 05:07:40 PMDo you have an ICMP LAN allow firewall rule? Source LAN Network -> Anywhere
No, I assumed the wizard's "allow everything out" with "protocol = *" included ICMP... ?
Quote from: patient0 on July 20, 2026, 05:17:39 PMQuote from: miketubby on July 20, 2026, 04:09:52 PMran the setup wizard and set the WAN address to IPv4 static 77.**.**.55/28
If you set the WAN as static you have to manually set/choose the gateway in the interface settings. Setting a gateway makes it a WAN connection (for the system) and then the NAT rules are created automagically.
I added 77.**.**.49 as a Gateway... like I said I was able to ping 1.1.1.1 and 9.9.9.9 from a shell on the console - if the default gateway wasn't configured/working I wouldn't be able to get off my local LAN network...
Quote from: miketubby on July 20, 2026, 05:37:48 PMI added 77.**.**.49 as a Gatewa
You set that gateway in the WAN interface settings, in the field "IPv4 gateway rules"? If yes, then I don't know, works for me.
Quote from: patient0 on July 20, 2026, 05:40:51 PMQuote from: miketubby on July 20, 2026, 05:37:48 PMI added 77.**.**.49 as a Gatewa
You set that gateway in the WAN interface settings, in the field "IPv4 gateway rules"? If yes, then I don't know, works for me.
This. When you say you added the gateway, was that to the interface or to System->Gateways? You must set the upstream gateway on the WAN interface or that NAT rules won't be generated as it doesn't treat it as a path.
So, I flattened the system and re-installed 26.7 but this time allowed the suggested:
igb0 -> LAN
igb1 -> WAN
which is kinda backwards to my thinking since igb(0 = Outside) and igb(1 = Inside) so I always put the outside on the lowest numbered interface and in my setups there's always one outside interface and one ore more inside interfaces.
I didn't do any IP address assignments from the installer - I let it use DHCP for WAN and 192.168.1.1/24 for LAN.
I let the installation complete, rebooted, logged in, ran the setup wizard and it worked "out of the box" with the two audo generated source NAT rules being present.
So, now for some more prodding and poking - I'll probably flatten/install again and set just the inside network to 10.100.1.1/24 and see if that works with the wizard. Then I'll again and swap the interfaces back to igb0=outside and igb1=inside and see if that works...
Mike
The automatic or hybrid NAT function applies outbound NAT to all WAN interfaces. A WAN interface is one with an upstream gateway. So as @axsdenied already hinted at, something about your gateway configuration was not quite right.
Quote from: miketubby on July 20, 2026, 06:22:29 PMSo, I flattened the system and re-installed 26.7 but this time allowed the suggested:
igb0 -> LAN
igb1 -> WAN
which is kinda backwards to my thinking since igb(0 = Outside) and igb(1 = Inside) so I always put the outside on the lowest numbered interface and in my setups there's always one outside interface and one ore more inside interfaces.
That's 100% NOT THE ISSUE here :)
I have the same logic in my mind so my WAN is also igc0 since DAY #1 after installing OPNsense for the first time!
Don't worry about that ;)