slow dhcp on wan -> broken NAT

[synfinatic]

This was happening on 26.1.x and continues on 26.7.1.   I'm on AT&T fiber and using an AZORES WAS-110 fiber module/ONT to bypass the AT&T provided gateway.  For this to work, my `ixl0` interface uses DHCP/DHCPv6 to get IP addresses and I create a virtual IP (192.168.11.10/24) on `ixl0` in order to manage the WAS-110 module.

The problem is that for whatever reason, getting an IP address from AT&T is _slow_.  After rebooting the firewall, I often have to login and manually run `dhclient ixl0` to force it to try again and that works.  Once an IPv4 address is obtained, DHCPv6 seems to happen automatically.

The problem is that the system seems to not really register that an IPv4 address has been obtained and so NAT is broken- running `tcpdump -ni ixl0` shows traffic egressing with a source IP of 192.168.11.10- not the public IP that AT&T has given via DHCP.  I've figured out that I can fix this by going into the interface config setting and re-applying the existing settings, but this sucks.

Seems like the root cause of the issue is AT&T being slow to give out an IP address over DHCP- any way to make things more robust?

[synfinatic]

Meant to mention that for outbound NAT I'm using "Manual outbound NAT rule generation" and selecting NAT Address: "interface address"

[drosophila]

You are perfectly right: NAT uses the first IP address it finds, which will usually be the first the interface gets assigned. So if you assign the 192.168.11.10 as "virtual" but the primary assignment fails on first try, then, even if DHCP eventually succeeds, 192.168.11.10 will be first in the list and NAT will use that (check ifconfig output for the order, the GUI overview may lie about it). It can't know whether you want to NAT inter-LAN or towards the internet, after all, and there is no way to tell it.
I've had a similar issue and could fix it only by running a cron job that reorders the addresses every minute (the smallest interval it allows to use). Sucks big time.
In your case, it should be possible to hook into the "newwanip" trigger, since it gets a new WAN IP, which this trigger is all about. You'd still need to have a script for it and manually configure the trigger from the command line. Either way, it'll break on a fresh install because none of this gets stored in the config. :(

[synfinatic]

So looking again at the NAT settings, seems like there are 3 options in the drop down for `ixl0`:

* interface address
* ONTWAN address -- ONTWAN is the name for ixl0
* 192.168.11.10 ONT Management -- the virtual IP

Seems like using the 2nd option should provide the correct results?   Or are the 1st and 2nd effectively the same option with different names?