Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PFsense CE 2.5.1 NAT broken on interface != default WAN

    Scheduled Pinned Locked Moved NAT
    pfsense 2.5natbug2.5.1wan
    56 Posts 23 Posters 19.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • infosamu.itI
      infosamu.it
      last edited by

      I have the same issue. We have nat rules on a multiwan configuration. Upgrading from 2.5.0 to 2.5.1 nat rules on wan1 works but those on wan2 are not working.

      we had to restore from backup. :(

      F 1 Reply Last reply Reply Quote 1
      • F
        finnschi @infosamu.it
        last edited by

        +1 here I have the same issue with multi-WAN ..

        I was going nuts why my vpn wasnt working anymore... out of options I googled if it was a issue with 2.5.1..

        well at least I can stop blaming myself :P

        V 1 Reply Last reply Reply Quote 0
        • V
          vajonam Rebel Alliance @finnschi
          last edited by

          Think this was the fix.

          https://github.com/pfsense/FreeBSD-src/commit/cf7fd16ddcc36499c6dae90074335e889dc9e484

          infosamu.itI 1 Reply Last reply Reply Quote 0
          • infosamu.itI
            infosamu.it @vajonam
            last edited by

            @vajonam can you explain how to solve the issue?

            S V 2 Replies Last reply Reply Quote 0
            • S
              slu @infosamu.it
              last edited by

              @infosamu-it
              since the kernel must be rebuild, no chance to fix this with the patch package.
              We also wait for a new pfSense release since we have issues with this bug.

              pfSense Gold subscription

              1 Reply Last reply Reply Quote 0
              • V
                vajonam Rebel Alliance @infosamu.it
                last edited by vajonam

                @infosamu-it since netgate hasn't released the build tools, not much we can do but wait for the next release AFAIK. 2.6.0 is an option but there are a few issues with that I know of

                kernel panics #11839
                counters 0/0 #11775
                Also rate limiting seems broken as per another user. maybe related to #11775.

                pfsense fun!

                V 1 Reply Last reply Reply Quote 0
                • S
                  shpokas
                  last edited by

                  Any timeframe we can expect a fix to be released?
                  Neither downgrade nor development version seems a great choice.

                  V 1 Reply Last reply Reply Quote 0
                  • V
                    vajonam Rebel Alliance @shpokas
                    last edited by

                    I am also just a user who shares your pain, stuck on 2.5.1, any guesses will just be speculation at at this time.

                    joao mariaJ 1 Reply Last reply Reply Quote 0
                    • joao mariaJ
                      joao maria @vajonam
                      last edited by

                      @vajonam

                      tambem tive esse problema, resolvi assim
                      5fd539d0-1a09-4317-ae52-cbb60f30ed2b-image.png desabilito - starto o serviço depois desmarco e funcionou.

                      João Oliveira

                      V 1 Reply Last reply Reply Quote 0
                      • V
                        vajonam Rebel Alliance @joao maria
                        last edited by

                        @joao-maria Hmm.. not sure I wan to disable firewall :-)

                        1 Reply Last reply Reply Quote 0
                        • V
                          vajonam Rebel Alliance @vajonam
                          last edited by vajonam

                          @vajonam This is not true netgate has released the right build tools. together with another user I was able build the new kernel and install and can confirm it fixes the problem. so we have to hurry up and wait for a p1 or some such release officially.

                          For others interested.
                          https://github.com/Augustin-FL/building-pfsense-iso-from-source

                          S 1 Reply Last reply Reply Quote 1
                          • S
                            slu @vajonam
                            last edited by

                            @vajonam
                            thank you for this really detailed documentation!

                            Maybe you can help Netgate to build -p1? 😉

                            pfSense Gold subscription

                            1 Reply Last reply Reply Quote 1
                            • N
                              neo666
                              last edited by

                              After many months with 2.4.5 I finally decided to upgrade to 2.5.1 last weekend and now I'm really upset about not having read the release notes and seen this topic before.

                              Fortunately, I had few NAT rules on the secondary links and I managed to resolve it relatively quickly, but I will have to hope that my main link does not stop.

                              I am miles away from the server (which is physical), rollback to the previous version is unthinkable at the moment.

                              E 1 Reply Last reply Reply Quote 0
                              • E
                                encyklopedi @neo666
                                last edited by

                                @neo666 I have just updated my pfsense today to 2.6.0-devel and that solved the problem. And as you i am also upset that netgate can let this bug happen and not make an quick patch for 2.5.1. An other question i have is why is not the plus version of pfsense effected. Now i am forced to run devel version in production.

                                V S 2 Replies Last reply Reply Quote 1
                                • V
                                  vjizzle @encyklopedi
                                  last edited by vjizzle

                                  @encyklopedi The plus version is paid and despite Netgate saying they will treat pfsense CE the same as the Plus version, pfsense CE is on the slow-track. Bug is fixed in the Plus version within days, the CE version just a pet project. And nobody give me bs that it is fixed in 2.6 so CE is not going to be left behind! 2.6 and the CE version is just a big testing ground for Netgate so they can keep Plus version stable a reliable for paying customers. Why don’t they just admit it, would clear up a lot of confusion and people would be able to make a strategic choice if to continue with Netgate product or what version to choose.

                                  E 1 Reply Last reply Reply Quote 0
                                  • E
                                    encyklopedi @vjizzle
                                    last edited by

                                    @vjizzle I don't have a problem if that the case. But then should Netgate be open with that. So if people/corporations feel the need for quick support they know that they need to be on the plus-version and not on CE-version.

                                    V 1 Reply Last reply Reply Quote 1
                                    • V
                                      vjizzle @encyklopedi
                                      last edited by vjizzle

                                      @encyklopedi Exactly my point. Put your big-boy pants on and just come clean and do it quick.

                                      1 Reply Last reply Reply Quote 1
                                      • S
                                        shpokas @encyklopedi
                                        last edited by

                                        @encyklopedi

                                        Where does that leave the pfSense CE releases? This is a burning question for our users, and for good reason. ... We’re already planning a pfSense CE 2.6 release in mid-2021.

                                        So as I start to realize now, they won't do any bug fixes anymore. Screw you guys.

                                        S 1 Reply Last reply Reply Quote 1
                                        • S
                                          slu @shpokas
                                          last edited by slu

                                          I can not understand why this problem is not in the know issues list, people still run into this known issue...

                                          pfSense Gold subscription

                                          N 1 Reply Last reply Reply Quote 1
                                          • N
                                            neo666 @slu
                                            last edited by

                                            @slu

                                            @slu said in PFsense CE 2.5.1 NAT broken on interface != default WAN:

                                            I can not understand why this problem is not in the know issues list, people still run into this known issue...

                                            https://docs.netgate.com/pfsense/en/latest/releases/21-02-2_2-5-1.html

                                            It is in the release notes (link above), unfortunately I only found it when I was already facing the problem and after analyzing all my infrastructure because days before the firmware upgrade I had exchanged one of my gateways equipment and I thought it could be it.

                                            In my opinion the right thing would be to remove the download file as soon as the problem has been reported, since a solution apparently will not be quick.

                                            S 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.