OPNsense 26.7 doesn't NAT from LAN to WAN?

[miketubby]

I've just installed OPNsense 26.7 on a Sophos XG210 and the installation ran fine.

I assigned:

    igb0 -> WAN
    ibg1 -> LAN

I set the IP address on the LAN to 10.100.1.1/24 and logged in to the UI, set dark mode, ran the setup wizard and set the WAN address to IPv4 static 77.**.**.55/28 and it worked. The wizard completes successfully. DNSmasq is configured as a DHCP server.

A laptop connected to the LAN interface (wired Ethernet) obtains an IPv4 address via DHCP and can ping 10.100.1.1.

Going on the VGA console and starting a shell I can ping 1.1.1.1 and 9.9.9.9 okay.

Under Firewall > Rules the deault rule "Default allow LAN to any rule" is present.

Under Firewall > NAT > Source NAT > Automatic Source NAT Rule Generation shows no rules.  Changing to hybrid and adding a Source NAT rule for "LAN Address" to Any with Source NAT to WAN interface address adds the rule to the table but the laptop on the inside still cannot ping my default gateway or 1.1.1.1 or 9.9.9.9.

Am I missing something? I thought that OPNsense given just two interfaces automatically built the NAT from LAN -> WAN without any additional configuration and it worked "out of the box"?

Mike

[axsdenied]

Do you have an ICMP LAN allow firewall rule? Source LAN Network -> Anywhere

[patient0]

ran the setup wizard and set the WAN address to IPv4 static 77.**.**.55/28

If you set the WAN as static you have to manually set/choose the gateway in the interface settings. Setting a gateway makes it a WAN connection (for the system) and then the NAT rules are created automagically.

[miketubby]

Do you have an ICMP LAN allow firewall rule? Source LAN Network -> Anywhere

No, I assumed the wizard's "allow everything out" with "protocol = *" included ICMP... ?

[miketubby]

ran the setup wizard and set the WAN address to IPv4 static 77.**.**.55/28

If you set the WAN as static you have to manually set/choose the gateway in the interface settings. Setting a gateway makes it a WAN connection (for the system) and then the NAT rules are created automagically.

I added 77.**.**.49 as a Gateway... like I said I was able to ping 1.1.1.1 and 9.9.9.9 from a shell on the console - if the default gateway wasn't configured/working I wouldn't be able to get off my local LAN network...

[patient0]

I added 77.**.**.49 as a Gatewa

You set that gateway in the WAN interface settings, in the field "IPv4 gateway rules"? If yes, then I don't know, works for me.

[axsdenied]

I added 77.**.**.49 as a Gatewa

You set that gateway in the WAN interface settings, in the field "IPv4 gateway rules"? If yes, then I don't know, works for me.

This.  When  you say you added the gateway, was that to the interface or to System->Gateways? You must set the upstream gateway on the WAN interface or that NAT rules won't be generated as it doesn't treat it as a path.

[miketubby]

So, I flattened the system and re-installed 26.7 but this time allowed the suggested:

    igb0 -> LAN
    igb1 -> WAN

which is kinda backwards to my thinking since igb(0 = Outside) and igb(1 = Inside) so I always put the outside on the lowest numbered interface and in my setups there's always one outside interface and one ore more inside interfaces.

I didn't do any IP address assignments from the installer - I let it use DHCP for WAN and 192.168.1.1/24 for LAN.

I let the installation complete, rebooted, logged in, ran the setup wizard and it worked "out of the box" with the two audo generated source NAT rules being present.

So, now for some more prodding and poking - I'll probably flatten/install again and set just the inside network to 10.100.1.1/24 and see if that works with the wizard. Then I'll again and swap the interfaces back to igb0=outside and igb1=inside and see if that works...

Mike

[Patrick M. Hausen]

The automatic or hybrid NAT function applies outbound NAT to all WAN interfaces. A WAN interface is one with an upstream gateway. So as @axsdenied already hinted at, something about your gateway configuration was not quite right.

[nero355]

So, I flattened the system and re-installed 26.7 but this time allowed the suggested:

    igb0 -> LAN
    igb1 -> WAN

which is kinda backwards to my thinking since igb(0 = Outside) and igb(1 = Inside) so I always put the outside on the lowest numbered interface and in my setups there's always one outside interface and one ore more inside interfaces.

That's 100% NOT THE ISSUE here :)

I have the same logic in my mind so my WAN is also igc0 since DAY #1 after installing OPNsense for the first time!

Don't worry about that ;)