NAT Rules Revert to WAN When Deleting Underlying Interface on 2.6.0 (Possible Security Issue?)

[7666]

Hi,

I have a pfSense install, version 2.6.0-RELEASE, where I am experiencing unintended behavior that could possibly result in a security issue. I am trying to confirm whether or not this behavior is expected, and if it is not, if it has been patched in a later version of pfSense (I understand 2.6.0 is a tad old).

The issue is pretty simple. Say you have three interfaces, WAN, OPT1, and OPT2, and you have created NAT rules for OPT1 and OPT2, specifically port forwards. OPT1 and OPT2 are either OpenVPN or Wireguard tunnels. You decide you no longer need OPT2 and delete it from the interfaces page. Now, when you look at the NAT rules you had before, the OPT2 rules will have reverted to the WAN interface, as well as the correlating firewall rules allowing the traffic to pass. The problem is that this behavior is not communicated to the user and can lead to an unintended publishing of internal services to the WAN if any of the IPs or ports for the rule match up to a live service.

Steps to reproduce:

• Create a new interface. Name it whatever. For this exercise we'll use OPT2. Enable it.
• Add a port forward NAT rule tied to OPT2. Use whatever ports and IP you like. Commit the changes.
• Now delete OPT2 from the interfaces page entirely and head back to the NAT port forwards page.
• You should see that the port forward rule has now reverted to WAN without a message or even a change commit / reload required.
• Now go to the firewall page and observe the rule that was created for the port forward. It should also now be pointed to WAN, meaning it will actually work and forward traffic.

Is anyone else able to replicate this behavior? Does it happen on 2.7.0+? And is this expected? I worry that this could really bite someone in the behind if they have no idea it is happening. Either a confirmation or message to the user if port forwards are detected tied to an interface pending deletion, or a way to preserve the original deleted interface on the orphaned rules, would suffice to fix this.

-7666