Regression #11751: Input validation prevents creating 1:1 NAT rules on IPsec - pfSense - pfSense bugtracker

Actions

Copy link

Regression #11751

closed

Input validation prevents creating 1:1 NAT rules on IPsec

Added by Steve Wheeler about 3 years ago. Updated almost 3 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Viktor Gurov

Category:

Rules / NAT

Target version:

2.5.2

Start date:

03/29/2021

Due date:

% Done:

Estimated time:

Plus Target Version:

21.05

Release Notes:

Default

Affected Version:

2.5.0

Affected Architecture:

All

Description

Additional input validation in the GUI in 21.02/2.5 prevents creating a 1:1 NAT rule on the IPSec interface because it expects an IP family and enc doesnot have one:

The following input errors were detected:

    The interface do not have address from the specified address family.

Should also read "interface does not have address".

This is an edge case because NAT is not expected to work on IPSec. However there are situation where us can work and did in pfSense < 2.5.
Specifically if the P2 in use carries 0.0.0.0/0 it will carry the NAT'd traffic still.

This only applies to 1:1 NAT

Tested in:

21.02.2-RC (arm64)
built on Mon Mar 29 03:04:00 EDT 2021
FreeBSD 12.2-STABLE

Files

211.diff (3.21 KB) 211.diff

Viktor Gurov, 04/23/2021 12:12 AM

Actions

Copy link

Updated by Viktor Gurov about 3 years ago

Tracker changed from Bug to Regression

fix also includes OpenVPN and L2TP VPN input validation:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/211

Actions

Copy link

Updated by Jim Pingle about 3 years ago

Status changed from New to Pull Request Review

Actions

Copy link

Updated by Steve Wheeler about 3 years ago

Tested here against 21.02 snapshot. Works as expected.

Actions

Copy link

Updated by Alex Lost about 3 years ago

This bug quite ruined our environment.
Will be very greatfull for hotfix.

Actions

Copy link

Updated by Fiden Galvez almost 3 years ago

Hi Victor:
Please could you share again the fix, cause he link looks like it is dead.

Thank you

Actions

Copy link

Updated by Viktor Gurov almost 3 years ago

File 211.diff 211.diff added

Fiden Galvez wrote:

Hi Victor:
Please could you share again the fix, cause he link looks like it is dead.

Actions

Copy link

Updated by Jim Pingle almost 3 years ago

Status changed from Pull Request Review to Feedback
Target version changed from CE-Next to 2.6.0

PR was merged yesterday.

Actions

Copy link

Updated by Jim Pingle almost 3 years ago

Plus Target Version set to 21.05

Actions

Copy link

Updated by Jim Pingle almost 3 years ago

Already in 21.05 branch.

Actions

Copy link

#10

Updated by Jim Pingle almost 3 years ago

Subject changed from Input validation prevents 1:1 NAT rules on IPSec to Input validation prevents creating 1:1 NAT rules on IPsec
Category changed from Web Interface to Rules / NAT

Updating subject for release notes.

Actions

Copy link

#11