Feature Request: manage Virtual IP and 1:1 NAT rules

opoplawski / ansible-pfsense

Ansible modules for managing pfSense firewalls

GNU General Public License v3.0

266 stars 48 forks source link

Feature Request: manage Virtual IP and 1:1 NAT rules #50

Closed RussellBeardon closed 1 year ago

RussellBeardon commented 4 years ago

Hi, these modules have been extremely helpful. I would love to see virtual IP management and 1:1 NAT rule management.

Regards

Russell.

opoplawski commented 4 years ago

Pull requests welcome! :) Seriously, the main developers are both pretty strapped for time and we work on our own itches. Creating and tweaking modules is really not that hard to do. See the wiki for more information. Thanks.

f-bor commented 4 years ago

I wrote a beginning for the vip module (the static ip/net part) monthes ago but I didn't got time for the unit tests since then. I'll publish it later today with a notice warning "use at your own risk".

f-bor commented 4 years ago

I was feeling bad to publish not well tested code. So I wrote unit tests and found some bugs. I reread pfSense source for virtual ips and saw a large block of code to implement in python to validate deletions. As I'm tired of this (rewriting pfSense code, it's endless), I have opened a feature request about moving pfSense logic code in some place where we could call it directly threw phpshell. I will resume the work on this module following the answer of the pfSense team.

Here is the feature request if you want to jump in: https://redmine.pfsense.org/issues/10641

RussellBeardon commented 4 years ago

Thank you for the response. I understand the time constraints involved and appreciate the work done so far. I'll look through the code and see if I can upgrade my skills and contribute what I can.

f-bor commented 4 years ago

@opoplawski so we will have to wait until they release the restconf api. It was planned for 2.5.0 but it was postponed. Since they will require aes-ni support (https://www.netgate.com/blog/more-on-aes-ni.html), I don't see it before 2.6.0. So I think it's safe to assume we won't have a nice pfSense api to call before 3 or 4 years.

Meanwhile, we have several possibilities:

do no checks (like others with their pfsense modules)
do exactly the same checks than pfSense
maybe find an intermediary solution and do what seems the most important checks / ignore the rare use cases

I'd like to have your thoughts on this.

opoplawski commented 4 years ago

Well, it's nice to see that it is still in their plans, but since they have been talking about it already for at least 5 years, I think your time lime might be a bit optimistic :smirk: .

I think we're always going to fall into the third bullet - a best effort attempt to keep people from shooting themselves in the foot too badly - but clearly we can't implement everything.

FerNandoSed commented 3 years ago

Hi! Thank you for building such helpful module, I've been using for a couple of months and so far it has been a great experience.

I know there is work in progress related to the virtual IP module, but I wonder if there are any plans to bringing it to upstream. I also have written (actually copied and modified form other module) a module for virtual IP, which lack some features (other and proxyarp), but so far is working as expected for carp and ipalias.

Is it OK to open a PR for this module, or should I wait for the original module to be merged?

Best regards,

opoplawski commented 1 year ago

Closing this repository down, file new requests in pfsensible/core