[solved] Likely messed up NAT conversions from old to new rules. How to clean up?

[really_lost]

I'm on 26.10.  I had upgraded from old to new rules a few months ago in prepartion.

I recently realized that the two Source NAT rules I should have in place are not listed.  However, the rule still works.

Doing a pfctl -s nat lists those two rules.  They survive a reboot.  My assumption is I didn't properly migrate them. 

I'm looking for advice on how to fix this.  My assumption is install the os-firewall-legacy plugin, complete the migration, and remove the plugin.

[nero355]

- You know the NAT Rule is there.
- You can Copy->Paste it anywhere.

So maybe :
1. Export the NAT Rules you have now.
2. Check how they look in the .CSV file.
3. Create a new .CSV file that contains your "missing" NAT Rules in the same format.
4. Import them into the new Source NAT Rules.

In general you should not need the old Outbound NAT webGUI plug-in unless you want to edit old Outbound NAT Rules first.

[really_lost]

So maybe :
1. Export the NAT Rules you have now.

I can't export to a CSV because the old rules section isn't there anymore in 26.10.  That's why I was wondering if it is as simple as installing the old rule plugin and then proceeding.

I can easily recreate the rules fresh, but given that they somehow exist, I'm not certain what would happen if I tried that.

[viragomann]

That's why I was wondering if it is as simple as installing the old rule plugin and then proceeding.

This worked for me on 26.7.8.
Installed the legacy rules plugin, exported the outbound NAT rules and imported the file on the source NAT page and deleted the old rules finally.
After this was done, I removed the plugin again.

[Manfred.Knick]

C.f. Migration Notes:

(o) The static PHP pages for firewall rule and outbound NAT management have been moved to the "os-firewall-legacy" plugin which can be manually installed before or after the upgrade.  All rules will continue to work regardless of the plugin being installed or not and are easily migrated using the given assistant found in the menu under Firewall: Migration assistant.

AFAICS, this was offered as long as "old" rules were around.
After all were migrated, this menu entry did not show up any more.

Having migrated early, I can't test if the plugin is necessary for the Migration assistant.

Hth.

[really_lost]

Installing the legacy firewall plug-in, performing the migration I missed on NAT, and uninstalling the legacy plugin worked.