"WAN address" in port forwarding includes VIP addressess.

[MaartenJB]

Hi,

If I use "WAN address" when creating a Port forward, it forwards the port on the "WAN address" AND all VIP's on that interface. If you want to only forward to the WAN IP you need to create an extra VIP alias containing the WAN IP.

Best regards,

Maarten

OPNsense 18.1.9-amd64
FreeBSD 11.1-RELEASE-p10
OpenSSL 1.0.2o 27 Mar 2018

[AdSchellevis]

Could probably be fixed like d823cc7 "interface address" converts to "interface" now where it could be "interface:0".

[AdSchellevis]

@fichtner we probably shouldn't add this in a minor release, there are some side affects people might not expect, such as:

• Anti lockout rule not being applied to the VIPs
• Current firewall rules to "Interface address" won't match on VIPs

What do you think?

[fichtner]

Easy enough to apply via patch, let's keep this away from 18.1.x and make it the default again in 18.7 👍

[fichtner]

Decided to revert, need to solve this another way as :0 interferes with IPv6 connectivity.

[andrewhotlab]

It would be very nice to have a fix to this: a customer of us just noticed this problem and asked for a solution. In the mean time, we trained them to always put the primary IP address of the WAN interface in the rule, but actually this might not be always feasible: for example, when the WAN is configured as PPPoE or DHCP client.

Thanks for your efforts!

[fichtner]

@AdSchellevis keep or close?

[AdSchellevis]

@fichtner let's close it, if at some point in time :0 starts working like it should, we can always reopen.

[MaartenJB]

Why would you close an issue which is not fixed yet? Doesn't make sense to me.

[fichtner]

There's no easy way out here and the first attempt to correct this was problematic within pf(4) code. Now not enough community feedback to work with. We close it according to our contribution rules.

https://github.com/opnsense/core/blob/master/CONTRIBUTING.md

[fichtner]

The revert decision in question is about lax handling of :0 in IPv6. We did add a patch eventually via https://github.com/opnsense/changelog/blob/da9944d43c1fe4466cab2e624727b1ad5f256ca9/community/20.7/20.7.2#L43 but since there are possibilities for primary address to be link-local only on an IPv6 WAN the use of :0 will silently fail.

The best way is likely to add another shortcut that supports single GUA support as an alternative here and leave the existing one as is maybe minus a tweak of the current label.

[hatclub]

Having just apparently trodden on this rake, could the incorrect wording of "WAN address" in the NAT rule builder at least be replaced with something clearly indicating "All IPs bound to WAN interface" (which, honestly, I do not think many people will see as the expected/desirable behaviour)?

We do not see this behaviour in another pf-based firewall, so I am interested in how this problem would be unresolvable for opnsense.