Can't make a zone based outbound SNAT rule in luci anymore?

Dreki · June 4, 2020, 6:37pm

I just got the update to 5.0 today and everything seems to be working except I am not able to make a firewall rule in luci like I was able to before.

I have 5 external IPs from my ISP and I have a wifi network that is configured in a firewall zone called “ZHADUM” every device that connects to ZHADUM wifi is part of the corresponding firewall zone.

I need to make a rule that routes all outbound traffic from ZHADUM zone to wan via a specific external IP address.

I was able to make this rule inside the luci web interface before but now if i try to make the rule, I add a NAT rule there is no option to set source zone, only outbound zone.

I tried to make a rule in /etc/config/firewall but I wasn’t able to figure out what exactly to add to make this happen.

I edited my post because I meant luci not forris

czlada · June 4, 2020, 7:03pm

Luci have new tab for NAT ruses. Try: Router IP/cgi-bin/luci/admin/network/firewall/snats

Dreki · June 4, 2020, 7:05pm

Yes thats the tab I am currently in. but if you click add, there is no option to add a source zone like there was before, only a destination zone.

If i do that it routes all outbound traffic from all zones via the selected IP which isn’t what I need.

czlada · June 4, 2020, 7:28pm

If I select lan in the Outbound zone, it will be written to the firewall as: src = ‘lan’
Possible error in translation. It does not work like this set?

Dreki · June 4, 2020, 7:41pm

No in that case it rewrites the address of incoming connections TO “lan” not FROM “lan”. That selector is only selecting the destination zone, not the source zone. I just tried it to be sure.

Dreki · June 4, 2020, 7:42pm

The old Luci interface had two selectors here to pick both the source and destination zones.

Dreki · June 4, 2020, 7:47pm

Also it is worth noting that if you are in the list of SNAT rules, it even lists the rule as having destination rule and no source rule. see the attached screenshots.

Dreki · June 10, 2020, 9:48pm

Does anyone have any advice? Is this something I should report as a bug somewhere considering that it seems to be a feature that was removed, perhaps by accident?