Outbound NAT - Source NAT Migration: WireGuard Network in Auto-Configuration

[Wrigleys]

Dear All

I'm successfully upgraded my Outbound NAT rules to Source NAT with the exceptional help of your migration tool! It was a flawless operation. Highly appriciated!
The only thing I didn't see is my WireGuard network, which isn't listed in "Automatically generates rules" in Source NAT (it's automatically listed in Outbound NAT).

Does I need to add this network manually or will this be added in a future update?

Thanks for your help.

All the best,
Wrigleys

[Monviech (Cedrik)]

Did the automatic wireguard network outbound rule ever work? What I have seen is that most users created manual rules for that.

[Wrigleys]

Hi Monviech,

For IPv4, I think so yes. I followed the official WireGuard Road Warrior Setup Guide and assigned an interface as mentioned in Step 4(a).

I expect that my WireGuard setup will no longer work without additional created Source NAT Rules, when Outbound NAT will be removed in future Releases.

All the best,
Wrigleys

[Monviech (Cedrik)]

Don't worry.

The Outbound NAT rules are generated here:
https://github.com/opnsense/core/blob/70be6992f8e30cd8b35cedb7fc985f3942ccd29b/src/etc/inc/filter.inc#L208-L243

What you see as automatic rules in the Source NAT grid, is only a synthetic approximation:
https://github.com/opnsense/core/blob/70be6992f8e30cd8b35cedb7fc985f3942ccd29b/src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/SourceNatController.php#L52-L54

This means your automatic Wireguard rules most likely exist, they are just not displayed in the grid right now.

Check that via:

# pfctl -s nat