opnsense / core

OPNsense GUI, API and systems backend
https://opnsense.org/
BSD 2-Clause "Simplified" License
3.36k stars 753 forks source link

NAT Port Forward "Redirect Target IP" does not allow using built in interface addresses #7809

Open lanrat opened 2 months ago

lanrat commented 2 months ago

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug

When creating a NAT port Forward, the "Redirect target IP" field allows the use of Firewall Aliases, but it does not allow the use of interface addresses such as "LAN Address". Other firewall rules (not in the NAT section) do not have this limitation.

For interfaces with dynamic IPs such as a WAN address, or a IPv6 Address with a dynamic prefix, it is not always possible to know the exact IP address to use, making the Interface Address option very useful.

To Reproduce

Steps to reproduce the behavior:

  1. Go to Firewall -> NAT -> Port Forward
  2. Click on New(+)
  3. Scroll down to "Redirect target IP"
  4. See Only Aliases, and not Interface addresses.

Expected behavior

The "Redirect target IP" dropdown should list Interface addresses just like normal firewall rules.

Describe alternatives you considered

I have attempted to use Aliases to work around this. However I have not found a way to make an alias that covers a dynamic interface address.

Screenshots

Screenshot of NAT Port Forward Target IP dropdown: image

Screenshot of Source/Destination dropdown for normal firewall rules, listing Interface Addresses. image

Environment

OPNsense 24.7.2 (amd64).