24.1.9 NAT Reflection

[danderson]

Since 24.1.9 update,   Reflection for 1:1 seems to not be working, prior my internal clients hitting the NAT address would get the correct server, now they are landing on the firewall. I.e. https lands on the opnsense login page instead of the box that I want and that was working previously.

This is for 1 to 1 NAT rules that im having issues with since the upgrade.

[wirehire]

After update to 24.1.9 1:1 Nat outbound was not working anymore, the outbound rule over a specific ip was deleted.

[groove21]

How do you got this working again? Help very much appreciated :)

[wirehire]

do you mean me? i recover the rules from a backup config file, for the outbound NAT.

[ProximusAl]

Probably something to do with this:

o firewall: migrate one-to-one NAT to MVC/API

[groove21]

Yes I exactly also think, that this is the cause.
I also started a topic in the German forum. I restored a snapshot of my OPNsense (it runs within Proxmox).
I´m just curious what new rule is needed to get it working again with the new version.

see: https://forum.opnsense.org/index.php?topic=41119.0

[franco]

Thanks, we will take a look now.


Cheers,
Franco

[groove21]

Thanks for investigating Franco. I will wait with any further update :)

[franco]

Can someone with snapshot capability give me a diff of the good 24.1.8 and bad 24.1.9 file /tmp/rules.debug ?

# diff -u old.file new.file


Thanks,
Franco

[Monviech (Cedrik)]

This is most likely only a problem when using the automatic reflection options. When configuring manual NAT reflection for everything, I imply that the setup should remain non effected.

Example:

https://docs.opnsense.org/manual/how-tos/nat_reflection.html#one-to-one-nat-reflection

If something has changed here with the new update, please ping me too so I can adjust this tutorial.

[franco]

To me it looks like the "NAT reflection" for each rule got lost in the migration, so editing the rule to enable it should bring it back?

If that's the case we can't bring the lost setting back with a patch, but we can prevent this from happening to anyone else still on a version below 24.1.9.


Cheers,
Franco

[franco]

I'll hotfix this later today.

https://github.com/opnsense/core/commit/324f5351

(no use applying this one, just for reference)

[franco]

Hmm, more importantly this was omitted from the dialog...

https://github.com/opnsense/core/commit/bde656669

# onsense-patch bde656669

In order to set it back to what it was supposed to do.


Cheers,
Franco

[danderson]

can confirm this fixed my 1:1 NAT Reflection issues.

Hmm, more importantly this was omitted from the dialog...

https://github.com/opnsense/core/commit/bde656669

# onsense-patch bde656669

In order to set it back to what it was supposed to do.


Cheers,
Franco

[franco]

Neat, thanks for confirming!