Would it be Forwarding or Outbound?

johnpoz

@o12eMaRkAbLeo so the rules are not actually reloading.. Did you try a force reload? Your not seeing any errors if you click the monitor the reload

o12eMaRkAbLeo

@johnpoz

How would I go about force reloading?

No I am not seeing any errors from the web gui after saving the settings.

johnpoz

@o12eMaRkAbLeo said in Would it be Forwarding or Outbound?:

force reloading?

under status, filter reload, you can then watch the load process, etc.

edit: also since know your on 2.7.1 and I am on 23.09 I fired up my 2.7.1 to see if could duplicate your problem.. And works just like it should.. You can no outbound rule.. Then created a rule, and its there when I use pfctl -sn

o12eMaRkAbLeo

@johnpoz

Just did a "pfctl -F all" and rebooted. No change.

johnpoz

@o12eMaRkAbLeo so your able to add other rules and port forwards.. Can you remove all your port forwards...

Your just not able to create a static port.. So create some sort of other rule just on your lan or wan interfaces.. And they get added when you look at the full rules.

https://docs.netgate.com/pfsense/en/latest/firewall/pf-ruleset.html

You just can not set a static outbound?

Calling in @stephenw10 maybe he has some idea.. I can not reproduce it that is for sure, not on my 23.09 or my 2.7.1 vm.

edit: example - just created a bogus rule on my lan, and if I look at all my rules with the pfctrl -sr I see that rule added

DUDE!!!! You have the rule disabled!!!???

If you I disable a rule, it goes grey

But that doesn't show up on yours?? Something is for sure off.. I tried changing my theme to dark and dark-beta, but if I disable the rule it puts a checkmark.. But from your post sure looks like the rule is disabled?? But its not a checkmark and the rule isn't greyed out going to an X, so it should be active.. But its not in your full rule list, which would explain why its not working..

I am really at a loss to what could be going on.. You can created other rules and they show up in the pfctl right? See my test from above.

o12eMaRkAbLeo

@johnpoz

No. The rule is not disabled.

But also the new rule that I put on .11 isn't showing up in the pfctl output either.....

New rule

Pfctl -sn output

johnpoz

@o12eMaRkAbLeo no just create a normal rule on some other interface.. The rule doesn't really have to do anything actually, it never has to trigger just want to see if your having this issue with all rules or just outbound nat..

See how I created a dummy rule that would never trigger on my lan because there a any any rule above it.. But when I create it shows up in the rules via the pfctl cmd

Looks like for some reason your not actually in hybrid mode, and only your automatic rules are showing.

o12eMaRkAbLeo

@johnpoz

I have already done that I think yesterday.

The .11 isn't showing up in the pfctl -sn output. That is why I decided to build the rule to allow static porting on ipv6 to see if it would show up in the output. It is but still not accepting the static routing.

Assigned another network port to LAN2

pfctl -sn output after changes

johnpoz

@o12eMaRkAbLeo on your normal lan, just a normal rule - not a outbound nat.. See my above example where I did it on my lan.. Nothing to do with nat.. Just a rule on an interface.

I want to verify its just outbound nat your having a problem with and not writing rules in general..

o12eMaRkAbLeo

@johnpoz

pfctl -sr | grep Factorio

johnpoz

@o12eMaRkAbLeo and that tells me nothing.. Where is the new rule you created? you grep for Factorio - and thre is no rules on your lan for that in your gui post.

See above I created what was clearly a new rule TestRule - and then I look for that in my rules via sr and you can clearly see it there.

o12eMaRkAbLeo

@johnpoz

After adding the same exact output "pfctl -sr | grep Factorio" no change.

johnpoz

@o12eMaRkAbLeo so no rules are being added then..

Vs using some rule wiith a name on that you already have listed in your rules.. Wouldn't it have been easier and clearer to call it say "testrule:" or testnewrule..

o12eMaRkAbLeo

@johnpoz

This could be true but I wanted to involve everything that we are working on.

But technically that isn't true. I did at the ipv6 NAT rule I put in place...

johnpoz

@o12eMaRkAbLeo said in Would it be Forwarding or Outbound?:

at the ipv6 NAT rule

Huh - why would you create a IPv6 nat rule????? That makes no sense..

Could you just do a clear and simple test.. add a rule on lan, with a very easy to understand description that doesn't line up with what your doing.. like testnewrule and then look in your rules.. Do you see that new rule or not?

https://docs.netgate.com/pfsense/en/latest/troubleshooting/firewall.html#ruleset-failing-to-load