Skip to content

Commit a0f2216

Browse files
author
Jared Hendrickson
committed
Created new endpoint to create, read, update and delete 1:1 NAT mappings, created unit test for 1:1 NAT endpoint, updated documentation, fixed bug that prevent interface from being located when using default description
1 parent 656340e commit a0f2216

12 files changed

Lines changed: 1084 additions & 15 deletions

‎README.md‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -508,6 +508,13 @@ There is no limit to API calls at this time but is important to note that pfSens
508508

509509
* [Read NAT](#1-read-nat)
510510

511+
* [FIREWALL/NAT/ONE_TO_ONE](#firewallnatone_to_one)
512+
513+
* [Create NAT 1:1 Mappings](#1-create-nat-1:1-mappings)
514+
* [Delete NAT 1:1 Mappings](#2-delete-nat-1:1-mappings)
515+
* [Read NAT 1:1 Mappings](#3-read-nat-1:1-mappings)
516+
* [Update NAT 1:1 Mappings](#4-update-nat-1:1-mappings)
517+
511518
* [FIREWALL/NAT/PORTFOWARD](#firewallnatportfoward)
512519

513520
* [Create NAT Port Forwards](#1-create-nat-port-forwards)
@@ -1019,6 +1026,184 @@ URL: https://{{$hostname}}/api/v1/firewall/nat
10191026

10201027

10211028

1029+
## FIREWALL/NAT/ONE_TO_ONE
1030+
1031+
1032+
1033+
### 1. Create NAT 1:1 Mappings
1034+
1035+
1036+
Add a new NAT 1:1 Mapping.<br><br>
1037+
1038+
_Requires at least one of the following privileges:_ [`page-all`, `page-firewall-nat-1-1-edit`]
1039+
1040+
1041+
***Endpoint:***
1042+
1043+
```bash
1044+
Method: POST
1045+
Type: RAW
1046+
URL: https://{{$hostname}}/api/v1/firewall/nat/port_forward
1047+
```
1048+
1049+
1050+
1051+
***Query params:***
1052+
1053+
| Key | Value | Description |
1054+
| --- | ------|-------------|
1055+
| interface | string | Set which interface the mapping will apply to. You may specify either the interface's descriptive name, the pfSense ID (wan, lan, optx), or the physical interface id (e.g. igb0). Floating rules are not supported. |
1056+
| src | string | Set the source address of the mapping. This may be a single IP, network CIDR, alias name, or interface. When specifying an interface, you may use the physical interface ID, the descriptive interfance name, or the pfSense ID. To use only interface address, add `ip` to the end of the interface name otherwise the entire interface's subnet is implied. To negate the context of the source address, you may prepend the address with `!` |
1057+
| dst | string | Set the destination address of the mapping. This may be a single IP, network CIDR, alias name, or interface. When specifying an interface, you may use the physical interface ID, the descriptive interface name, or the pfSense ID. To only use interface address, add `ip` to the end of the interface name otherwise the entire interface's subnet is implied. To negate the context of the source address, you may prepend the address with `!` |
1058+
| external | string | Specify IPv4 or IPv6 external address to map Inside traffic to. This Is typically an address on an uplink Interface. |
1059+
| natreflection | string | Set the NAT reflection mode explicitly. Options are `enable` or `disable`. (optional) |
1060+
| descr | string | Set a description for the mapping (optional) |
1061+
| disabled | boolean | Disable the mapping upon creation (optional) |
1062+
| nobinat | boolean | Disable binat. This excludes the address from a later, more general, rule. (optional) |
1063+
| top | boolean | Add this mapping to top of access control list (optional) |
1064+
| apply | boolean | Immediately apply this mapping after creation (optional) |
1065+
1066+
1067+
1068+
***Body:***
1069+
1070+
```js
1071+
{
1072+
"interface": "WAN",
1073+
"src": "any",
1074+
"dst": "em0ip",
1075+
"external": "1.2.3.4",
1076+
"natreflection": "enable",
1077+
"descr": "Test 1:1 NAT entry",
1078+
"nobinat": true,
1079+
"top": false,
1080+
"apply": true
1081+
}
1082+
```
1083+
1084+
1085+
1086+
### 2. Delete NAT 1:1 Mappings
1087+
1088+
1089+
Delete an existing NAT 1:1 mapping by ID.<br>
1090+
1091+
_Requires at least one of the following privileges:_ [`page-all`, `page-firewall-nat-1-1-edit`]
1092+
1093+
1094+
***Endpoint:***
1095+
1096+
```bash
1097+
Method: DELETE
1098+
Type: RAW
1099+
URL: https://{{$hostname}}/api/v1/firewall/nat/port_forward
1100+
```
1101+
1102+
1103+
1104+
***Query params:***
1105+
1106+
| Key | Value | Description |
1107+
| --- | ------|-------------|
1108+
| id | string or integer | Specify the 1:1 NAT mapping ID to delete |
1109+
| apply | boolean | Immediately delete this mapping rule (optional) |
1110+
1111+
1112+
1113+
***Body:***
1114+
1115+
```js
1116+
{
1117+
"id": 0,
1118+
"apply": true
1119+
}
1120+
```
1121+
1122+
1123+
1124+
### 3. Read NAT 1:1 Mappings
1125+
1126+
1127+
Read 1:1 NAT mappings.<br><br>
1128+
1129+
_Requires at least one of the following privileges:_ [`page-all`, `page-firewall-nat-1-1`]
1130+
1131+
1132+
***Endpoint:***
1133+
1134+
```bash
1135+
Method: GET
1136+
Type: RAW
1137+
URL: https://{{$hostname}}/api/v1/firewall/nat/one_to_one
1138+
```
1139+
1140+
1141+
1142+
***Body:***
1143+
1144+
```js
1145+
{
1146+
1147+
}
1148+
```
1149+
1150+
1151+
1152+
### 4. Update NAT 1:1 Mappings
1153+
1154+
1155+
Update an existing NAT 1:1 Mapping.<br><br>
1156+
1157+
_Requires at least one of the following privileges:_ [`page-all`, `page-firewall-nat-1-1-edit`]
1158+
1159+
1160+
***Endpoint:***
1161+
1162+
```bash
1163+
Method: PUT
1164+
Type: RAW
1165+
URL: https://{{$hostname}}/api/v1/firewall/nat/port_forward
1166+
```
1167+
1168+
1169+
1170+
***Query params:***
1171+
1172+
| Key | Value | Description |
1173+
| --- | ------|-------------|
1174+
| id | integer | Specify the ID of the 1:1 mapping to update. |
1175+
| interface | string | Update which interface the mapping will apply to. You may specify either the interface's descriptive name, the pfSense ID (wan, lan, optx), or the physical interface id (e.g. igb0). (optional) |
1176+
| src | string | Update the source address of the mapping. This may be a single IP, network CIDR, alias name, or interface. When specifying an interface, you may use the physical interface ID, the descriptive interfance name, or the pfSense ID. To use only interface address, add `ip` to the end of the interface name otherwise the entire interface's subnet is implied. To negate the context of the source address, you may prepend the address with `!` |
1177+
| dst | string | Update the destination address of the mapping. This may be a single IP, network CIDR, alias name, or interface. When specifying an interface, you may use the physical interface ID, the descriptive interface name, or the pfSense ID. To only use interface address, add `ip` to the end of the interface name otherwise the entire interface's subnet is implied. To negate the context of the source address, you may prepend the address with `!` (optional) |
1178+
| external | string | Update the IPv4 or IPv6 external address to map Inside traffic to. This Is typically an address on an uplink Interface. (optional) |
1179+
| natreflection | string | Update the NAT reflection mode explicitly. Options are `enable` or `disable`. (optional) |
1180+
| descr | string | Update the description for the mapping (optional) |
1181+
| disabled | boolean | Enable or disable the mapping upon update. True to disable, false to enable. (optional) |
1182+
| nobinat | boolean | Enable or disable binat. This excludes the address from a later, more general, rule. True to disable binat, false to enable binat. (optional) |
1183+
| top | boolean | Move this mapping to top of access control list upon update (optional) |
1184+
| apply | boolean | Immediately apply this mapping after update (optional) |
1185+
1186+
1187+
1188+
***Body:***
1189+
1190+
```js
1191+
{
1192+
"interface": "LAN",
1193+
"src": "10.0.0.0/24",
1194+
"dst": "!1.2.3.4",
1195+
"external": "4.3.2.1",
1196+
"natreflection": "disable",
1197+
"descr": "Updated test 1:1 NAT entry",
1198+
"disabled": true,
1199+
"nobinat": false,
1200+
"top": true,
1201+
"apply": false
1202+
}
1203+
```
1204+
1205+
1206+
10221207
## FIREWALL/NAT/PORTFOWARD
10231208

10241209

@@ -1057,6 +1242,7 @@ URL: https://{{$hostname}}/api/v1/firewall/nat/port_forward
10571242
| descr | string | Set a description for the rule (optional) |
10581243
| disabled | boolean | Disable the rule upon creation (optional) |
10591244
| top | boolean | Add this port forward rule to top of access control list (optional) |
1245+
| apply | boolean | Immediately apply this port forward rule after creation (optional) |
10601246

10611247

10621248

@@ -1105,6 +1291,7 @@ URL: https://{{$hostname}}/api/v1/firewall/nat/port_forward
11051291
| Key | Value | Description |
11061292
| --- | ------|-------------|
11071293
| id | string or integer | Specify the rule ID to delete |
1294+
| apply | boolean | Immediately delete this port forward rule (optional) |
11081295

11091296

11101297

@@ -1181,6 +1368,7 @@ URL: https://{{$hostname}}/api/v1/firewall/nat/port_forward
11811368
| descr | string | Update a description for the rule (optional) |
11821369
| disabled | boolean | Enable or disable the rule upon creation. True to disable, false to enable (optional) |
11831370
| top | boolean | Move this port forward rule to top of access control list (optional) |
1371+
| apply | boolean | Immediately apply the update to this port forward rule (optional) |
11841372

11851373

11861374

0 commit comments

Comments
 (0)