Open questions for Senaka (his firewall, four of them)

[ARSH871-bot]

These four have been blocking analysis of the client's real export since
mid-August. They are written down in CLAUDE.md §7 and on #78, and nowhere
that is easy to send him. Here they are in one place, in his language.

Each one is a real decision he has to make; none of them is something we can
work out ourselves.

1. An address for the WAN interface that carries rules.
It is DHCP or unconfigured. A Cisco ACL needs an address to bind rules to, so
those rules are currently skipped and named instead of guessed at.

2. What to do about two VPN interfaces.
His rules name WireGuard and openvpn, but neither is declared under
<interfaces>. That reads as tunnel policy rather than LAN filtering, and we
have treated it as out of scope. We would like that confirmed rather than
assumed.

3. NAT.
Two of his rules carry an associated-rule-id and are meaningless without the
NAT rule they belong to. We do not model NAT at all yet.

4. Whether missing fields are real, or an artefact of anonymising.
Some rules omit <type> or <protocol>. Our converter currently treats an
absent protocol as any and emits ip, which is the permissive direction. We
are not claiming that is what pfSense means by an omitted field — we are saying
what we do with it, and we would rather ask.

Why this is a discussion and not an issue

Nothing here is closed by a pull request. It closes when he answers. When he
does, the answer goes into docs/design/pfsense-nat-support.md and #78, and
this thread gets a link to it.

Ankeet owns #78 — Ankeet, add anything I have got wrong or left out before we
send it.

[patelankeet2]

Checked this against CLAUDE.md section 7's own record before answering. All four are accurate as written -- nothing wrong, nothing missing.

One suggestion, not a correction: if he only has time to answer one before we need to move, it should be question 1 (the WAN address). It is the one actually blocking the other three -- without an address to bind rules to, the interface cannot carry a Cisco ACL regardless of how he answers the VPN, NAT, or missing-field questions. Worth saying that to him directly so he prioritises it if he is short on time, even though the document itself does not need to change.

Good to send.