Project

General

Profile

Bug #4300

Can not enter outbound NAT destination port range

Added by Eric Hoffman over 4 years ago. Updated over 4 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Rules/NAT
Target version:
Start date:
01/26/2015
Due date:
% Done:

100%

Estimated time:
Affected Version:
2.2
Affected Architecture:

Description

In pfSense 2.1.5, I could enter an outbound NAT rule with destination port range, and in pfSense 2.2, I get error that destination port is invalid.

For example, I wish to create NAT from localhost to WAN on ports 1025:65535...

Steps:
- Add new outbound NAT rule
- Select interface: WAN
- Select source: Network - 127.0.0.0/8 - (port blank)
- Select destination: any - (ip blank) - port 1024:65535
- Description: (anything)
- Save

You get: The following input errors were detected: You must supply either a valid port or port alias for the destination port entry.

This used to work fine in prior version.

Workaround: Create an alias for your desired port range.

Associated revisions

Revision b601f897 (diff)
Added by Renato Botelho over 4 years ago

Accept port range on Outbound NAT. Fixes #4300

Revision 340e8bc5 (diff)
Added by Renato Botelho over 4 years ago

Accept port range on Outbound NAT. Fixes #4300

History

#1 Updated by Phillip Davis over 4 years ago

That behavior was changed by https://github.com/pfsense/pfsense/commit/9060f420a9444c68fc8db926787d0bb37d77ed72
Not sure if it was intentional to remove the ability to directly type a port range in that field - one of the devs can comment on that.

#2 Updated by Eric Hoffman over 4 years ago

Thanks for the head-up. It seem to be to fix bug #3857. I concur that the edit box is a single port entry, and should probably be validated the same as other single-ports edit boxes throughout the firewall. The validator is probably the same for other port edit boxes, and the firewall may have assumption elsewhere.

The devs can probably comment on that but I tend to be in favor of the new validation (to stay consistent with single-port vs port range GUI elements). If we wish to have port ranges entered directly, we could have multiple edit boxes/combo, like for the port forwarding port ranges.

#3 Updated by Eric Hoffman over 4 years ago

One note, it is to be noted that this does NOT seem to break update, nor backup/restore. I.e. on upgrade, from 2.1.5, the rules were kept as is. I was also able to restore a config in which I had the port range directly set for this field. So that's a good thing! But further editing of the "legacy" rule will whine until the port is set using an alias.

#4 Updated by Jim Pingle over 4 years ago

In the meantime, that field may also be left blank so that it affects all ports, not only that specific range.

#5 Updated by Chris Buechler over 4 years ago

  • Category set to Rules/NAT
  • Status changed from New to Confirmed
  • Target version set to 2.2.1

#6 Updated by Renato Botelho over 4 years ago

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100

#8 Updated by Chris Buechler over 4 years ago

  • Status changed from Feedback to Resolved

fixed

Also available in: Atom PDF