Port forwarding settings under rules AND destination NAT

[kaneelschep]

Hi all.


I run: OPNsense 26.7.5-amd64. This router has been running in this config for years now.
Yesterday I needed to enable some already long ago configured forwarded ports.
So I clicked on enable port under: Firewall / Rules. But somehow I was not getting through.
I checked a bit further and found the same rules under NAT / Destination NAT.
And only after I enabled them there too, the port was actually opened. The 2 dont seem to work together.

This is something new to me, as I did this same thing under rules a few months ago, and it just worked.
Is this a new thing? Or is something not correct.

I did do the 4/5 step migration wizard thingy of downloading the settings. Uploading them. And then the cleaning up last step.

Thanks!

[kaneelschep]

I have been reading a bit more on this. And I see there are quite some people asking about this. Yet I didnt really find an answer that explains me why the port forwarding is now handled in 2 separate locations. It seems confusing to me as it used to be in one location.
Also I cant find if this is by design or something just went wrong here during migrations/updates.
I am going to experiment a bit with making new rules and seeing how they end up in the destination nat.

Thanks!

[Bob.Dig]

And I see there are quite some people asking about this.

I think you are the only one. Portforwarding always has to do be done in NAT. There you decide, if you don't want to use a corresponding firewall rules by selecting "pass".

[kaneelschep]

I played around a bit and the port forward only works when enabled in both rules AND destination NAT. If either one is disabled, it will not work.
If I delete one of them. Either in rules or destination NAT, the port forward also does not work anymore.
Same goes for changing a rule or creating a new one. I will have to change or create them in both locations before they work.

Now I have been port forwarding for a long time in OPNsense.
And this used to be all done from 1 location. Not 2.

I know there were changes to this recently. Sp either something is wrong here. Or this might be the change?!
But it seems very illogical to have it in 2 locations, so my guess is something is wrong here.

Thanks!

[Bob.Dig]

You don't read?

[nero355]

You don't read?

I guess not... ^_^

Not your reply or the official documentation @ https://docs.opnsense.org/ sadly...

[kaneelschep]

From earlier posts, I was used to constructive help on this forum. Not to people just slapping each other with RTFM or STFU.
And then making fun about it with each other.
This kind of condescending communication is not constructive at all.

I tried to form some sense of your little unkind words. But I just did not understand. Because like I kept saying, it was different to what I was used to, and I didnt know if something went wrong during an update or something changed.
 
And something did change.
As I went over all the options in making a new rule in destination nat.
I found that the 3 options under: 'option firewall rule' are new (to me at least).
manual, pass, register rule.

All my rules seem to be manual, and that's why they both need to be updated. Unlike before, when I only updated in one location.
And this is why it behaved differently than I was used to.
The manual confirms that its new.
https://docs.opnsense.org/manual/nat.html#destination-nat-port-forward

Thanks.

[Patrick M. Hausen]

The "Firewall rule association" has been there for years including the "pass" option. It just changed to "Firewall rule" now.

[keeka]

I'm not sure where I got the following impression from, but my understanding of current NAT/Rule linkage is, choosing 'firewall rule' creates a rule for you but the association is not maintained (where it may have been before the overhaul). i.e. now, if you edit the port forward, the generated firewall rule does not get modified. I haven't tested this assumption as I tended to maintain firewall rules, even those associated with NAT, manually.

[nero355]

I'm not sure where I got the following impression from, but my understanding of current NAT/Rule linkage is, choosing 'firewall rule' creates a rule for you but the association is not maintained (where it may have been before the overhaul). i.e. now, if you edit the port forward, the generated firewall rule does not get modified. I haven't tested this assumption as I tended to maintain firewall rules, even those associated with NAT, manually.

IIRC you could be right, because there were some changes to that "logic" this year.

But as you can read @ https://docs.opnsense.org/ these days :
You are pretty much meant to create both NAT and Firewall Rules MANUALLY from now on to avoid any kind of misunderstandings/issues in the future !!

[franco]

To be frank the main change was to release the old "associated" rules into the manual scope and replace them with a pluggable rule using "register" which neatly follows the destination NAT rule always and can be updated by the system in the future.

Manual makes sense also, especially if you have a wider range of forwards that you want to handle with a single firewall pass rule instead.

Like always: it depends.  ;)


Cheers,
Franco

[nero355]

and can be updated by the system in the future.

So that feature will be added back in the system again in the future ?