Editing NAT rules vanishes aliases

[fraenki]

I've just updated from OPNsense 15.7.10-amd64 to 15.7.11. Now if I make changes to the outbound NAT fules (firewall_nat_out.php) ALL aliases will be vanished (firewall_aliases.php). I have verified that they are actually removed from config.xml.

I wasn't able to find any logs and the crash reporter didn't report a issue. Anything I could do to provide useful debug information? The problem is 100% reproduceable.

For the records, I've made a few changes to the system by applying AdSchellevis ipsec-related fixes (www/vpn_*, etc/inc/vpn.inc, etc/inc/vpn.inc). Editing IPsec configuration does NOT vanish aliases.

[AdSchellevis]

Hi Frank,

There are new versions available for (as good as) all firewall related pages, but to be honest, I can't find a direct reason why they would be flushed in the current version so I can't be 100% sure we solved this one as well.
Using the latest (now in dev) version I have saved multiple scenarios without loosing any of my aliases, so if you can find the time to retest when all new patches are in the release (or checkout the dev version) that would be very helpful.

The application flow in a lot of the old pages was quite messy, that's why we decided to do some thorough cleanup on the old front-end code as well for some areas, like ipsec, openvpn and firewall. Which should result in code which is easier to manage.
More will probably follow in the months to come.

Regards,

Ad

[fraenki]

Oh well, I guess applying only selected commits should be considered harmful. I've now also applied your updates to opnsense/mvc and opnsense/www/themes/opnsense and now the problem is solved.

Nightly builds/images would make it easier to test fixes.

[syserr0r]

I am experiencing this on a clean install of 15.7.11 (which is the latest "stable" version I can find).

I am still working on reproducing but this is the second time I have lost all port and ip aliases after editing Firewall NAT, Rules and virtual IPs.

Update: Just re-entered all aliases, edited the description of an outgoing NAT rule and lost them all again.

[fichtner]

15.7.12 is not going to have the new pages just yet, so still worth looking into.

[fichtner]

As a side note, aliases should still be in the backups, shouldn't they?

[syserr0r]

Excuse my ignorance, but what backups?

[fraenki]

@syserr0r Just in case you aren't aware of: you may easily restore your aliases by navigating to Diagnostics -> Backup & Restore -> Config History and revert to the previous configuration. This saved me a lot of hassle.
@fichtner Good point.

[syserr0r]

@fraenki Good to know, that will save me a lot of hassle -- thanks.

[fichtner]

Pages replaced.