Migrated to Source NAT already in 26.1. and had this configuration working. Something seems to have changed in 26.7.
I have a site with three uplink internet gateways. I run three instances of wireguard tunnels one through each gateway to one and same wireguard server. All three tunnels use different destination port. I have floating rules in place to select specific gateway based on the destination port.
Floating rules, the new ones, legacy rules are removed:
- Source=This firewall, Destination=WGserver, Port=GW1port, Gateway=GW1
- Source=This firewall, Destination=WGserver, Port=GW2port, Gateway=GW2
- Source=This firewall, Destination=WGserver, Port=GW3port, Gateway=GW3
All three gateways are on separate interfaces and IPv4 networks. Source NAT Mode=Manual Source NAT rule generation.
Tunnel 1 through primary connection (Gateway1) works as expected. Wireguard traffic source address is chosen as Interface1 address.
Tunnel 2 also works and traffic is routed through Gateway2 as expected. However, the source address for the tunnel2 traffic is still Interface1 address. This works as Gateway2 router is in my control and I can make it route Interface1/address originated packets back correctly. No NATting is needed.
Tunnel 3 does not work. I cannot control Gateway3 router and it rejects packets having Interface1 address as their source. And this is something I cannot change so I have to use Interface3 addresses.
On 26.1. I can do Source NAT- Interface=Interface1, DAddr=WGserver, DPort=GW3port, Translate Source IP=Interface3 address typed in as fixed IP address (not empty field=>Interface address)
- This configuration is slightly confusing but it works. I assume Source NAT configuration applies before firewall rules gateway selection and that's why I have to use Interface1 although packets leave from Interface3?
On 26.7.1_1 Same configuration does not work in the same way as in 26.1.- With the same working configuration used in 26.1. Tunnel3 traffic source address is indeed changed to Interface3 address but Tunnel3 traffic is sent to Gateway1 through Interface1 instead of Gateway3 through Interface3. It looks like the floating rules don't apply anymore.
- Without Source NAT configuration in place, Tunnel3 traffic is catched by floating firewall rule and the right Gateway3 is selected. Only the source address is from Interface1 and those packets are rejected by Gateway3.
- I have tried multiple configurations using Interface1 and Interface3 in the Source NAT but I have not found combination that would do both Source NAT and Gateway3 selection.
- Floating firewall rules are not touched.
Other Source NAT rules seem to work as they did in 26.1.
Any tips if this could be because of misconfiguration, expected change or corrected bug? Or is there something else I could try to force Source NAT address on the packets leaving from Interface3 to Gateway3?
Solved. This was probably an upgrade quirk. Solved by doing a fresh bootstrap install. Source NAT works as expected with same config as in 26.1.