Source NAT vs Outbound ?

[konrad63897]

Hi Stephan,

You're right.  We're talking about it right now.

Outbound -> Source NAT is not entirely ready yet. Likely for a later 26.7.x and 26.10.


Cheers,
Franco

Thanks for your information, so waiting for one of the next releases before migrating to "new" Source NAT.

[franco]

Sorry for the typo, I meant 'Stefan' of course

[keeka]

I also have a question OPNsense 26.1.11_6-amd64

I see under outbound hybrid ( legacy rules ), automatic rules including the below sources ( which is correct )

LAN networks, LAN_VL4 networks, LAN_VL23 networks, Loopback networks, au761nordvpncom networks, us9417nordvpncom networks, 127.0.0.0/8



I've upgraded to OPNsense 26.1.11_6-amd64, and run the migration wizard, on see the below SNAT automatic rules, which seems to be missing LAN networks, au761nordvpncom networks, us9417nordvpncom networks

Loopback network, LAN_VL4 network, LAN_VL23 network

LAN side Interfaces are;

LAN
LAN_VL4
LAN_VL23

Automatic rule generation is enabled
OPNsense is not handling VLAN tagging, ESXi vswitch handles all vlan tagging, and interfaces are presented as untagged interfaces to OPNsense VM

I realise the new SNAT section is work in progress. However I was surprised to see in @hharry's screenshot, some automatic NAT rules nicely grouped & displayed. My local interfaces are also non-VLAN, vtnet based in a VM. After seeing that screenshot was from 26.1.11_6, I was expecting to see something, but I none of the auto NAT rules are listed. FWIW I entered my SNAT rules manually earlier, prior to deleting them from NAT->Outbound, and I have hybrid mode enabled. All expected nat entries appear to be present under firewall diagnostics.

[franco]

Yes, there is a migration tool. As far as capabilities go outbound and source NAT shall be identical and the switch is mainly made to enable MVC/API access to that component. Outbound NAT will eventually move to the os-firewall-legacy plugin as well.


Cheers,
Franco

[keeka]

Yes, there is a migration tool. As far as capabilities go outbound and source NAT shall be identical and the switch is mainly made to enable MVC/API access to that component. Outbound NAT will eventually move to the os-firewall-legacy plugin as well.

Thanks @franco. I redefined my outbound rules under SNAT manually a while back and did not see or use the tool.
In order for auto NAT rules to be listed under the new SNAT interface (as per hharry's screenshot), do we need to run the tool? I cannot find it. I even added a temporary rule under old Outbound interface, in case this was needed to trigger the visibility of the tool.

[franco]

Auto-NAT rule are shared between both components, but don't show entirely on the source NAT page yet but they are in effect (the code for this did not change).

The migration tool was added in 26.1.11 so very recently.


Cheers,
Franco