Project

General

Profile

Bug #9446

Filter reload error with NAT reflection enabled

Added by Jim Pingle 8 months ago. Updated 7 months ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Rules / NAT
Target version:
Start date:
04/01/2019
Due date:
% Done:

100%

Estimated time:
Affected Version:
2.5.0
Affected Architecture:
All

Description

Recent 2.5.0 snap, hit this on reboot:

/tmp/rules.debug:112: rule expands to no valid combination

112:no nat on vmx1 proto tcp from vmx1 to 10.6.0.10 port 22

And several more like it.

Looks like the interface name as a source needs parens, so from (vmx1).

Associated revisions

Revision 8800ee6f (diff)
Added by Jim Pingle 8 months ago

Add parens around NAT reflection rule interface. Fixes #9446

Revision ff32782a (diff)
Added by Jim Pingle 7 months ago

Add parens around NAT reflection rule interface. Fixes #9446

(cherry picked from commit 8800ee6f90d2ac91ca9c2886bd260bc1a4e12893)

History

#1 Updated by Jim Pingle 8 months ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100

#2 Updated by Chris Linstruth 8 months ago

Getting parens on that interface. No rule loading errors:
eg. no nat on vtnet0 proto tcp from (vtnet0) to 172.25.236.240 port 8443

#3 Updated by Jim Pingle 8 months ago

  • Status changed from Feedback to Resolved

#4 Updated by Jim Pingle 7 months ago

  • Target version changed from 2.5.0 to 2.4.4-p3

#5 Updated by Jim Pingle 7 months ago

  • Status changed from Resolved to Feedback

#6 Updated by Chris Linstruth 7 months ago

2.4.4-p3 looks good:

  1. Reflection redirects and NAT for 1:1 mappings
    rdr on { vtnet0 vtnet2 enc0 openvpn } from any to 172.25.228.253 -> 172.25.233.101 bitmask
    no nat on vtnet0 from (vtnet0) to 172.25.233.101
    nat on vtnet0 from 172.25.233.0/24 to 172.25.233.101 -> 172.25.233.1 port 1024:65535

#7 Updated by Jim Pingle 7 months ago

  • Status changed from Feedback to Resolved

Also available in: Atom PDF