NAT Port forward cannot assign rule to multiple interfaces

[reetp]

This follows my post here
https://forum.opnsense.org/index.php?topic=3621.0

With a standard firewall rule you can assign it to multiple interfaces but when you create a NAT port forward you have to create a rule per interface.

I have 2 WAN interfaces and have a number of rules that apply to both interfaces and it is time consuming to set them up individually.

Is it possible to have a Multi Assign box for Interfaces in the Port Forwards ? I know it would be more complicated than just changing the drop down as you also need to code to create multiple rules but it would make creating rules a lot easier/quicker when you have multiple interfaces.

Obviously I could have missed something obvious here :-)

[AdSchellevis]

Hi John, you should be able to add an interface group and assign your combined rules to that. Can you test that?
Interfaces -> Other types -> Group

[reetp]

Hi Ad, yes I can do that :-)

It is a bit 'illogical' in that you can multi select in a normal FW rule but you cannot do that in NAT rules. It is not consistent.

As a result you do not then look at 'Groups' as you do not realise they are there or their relevance.

I also note you can even add a 'group' in the multi select as well which is confusing as well - is it right I can select WAN1, WAN2, AND a group containing WAN1 and WAN2 ?

It would be better to have either both drop downs as multi select, or neither with a note next to them to say something like 'If you want a rule for multiple interfaces create a group first'

Sorry - another one of those things where if you know, you know, but if you don't it is not obvious !

[AdSchellevis]

Hi John,

Floating rules are a left over from pfSense, I agree it would be better to only have one concept here (combine with groups)... but then again, we're not living in the ideal world. removing some functionality will be hard because of the number of people already using this as it is.

A lot can be solved with documentation, you could always volunteer for improving that.

[reetp]

No problems... this is effectively an 'Improvement' I guess. It isn't broken - just needs some better explanation and some 'tidying' eventually.

Happy to help with docs if required - just let me know how.

[AdSchellevis]

Help is always welcome :) If you write documentation about a subject we can add it to our documentation set. For more info about contributing, see https://docs.opnsense.org/contribute.html

When you're working on a particular section, just let us know, so we avoid working on the same topic.

[reetp]

LOL:-) OK. See what I can cook up on the subject