vyos@vyos:~$ show nat source rules Traceback (most recent call last): File "/usr/libexec/vyos/op_mode/show_nat_rules.py", line 43, in <module> Rule Source Translation Outbound Interface ---- ------ ----------- ------------------ comment = data['comment'] KeyError: 'comment'
Description
Details
- Difficulty level
- Normal (likely a few hours)
- Version
- -
- Why the issue appeared?
- Will be filled on close
- Is it a breaking change?
- Unspecified (possibly destroys the router)
- Issue type
- Bug (incorrect behavior)
Related Objects
- Mentioned In
- T4545: Rewrite show nat source rules
Event Timeline
Bug still present.
Version
vyos@vyos:~$ show ver Version: VyOS 1.4-rolling-202109240217 Release train: sagitta
Command Output:
vyos@vyos:~$ show nat source rules Traceback (most recent call last): File "/usr/libexec/vyos/op_mode/show_nat_rules.py", line 114, in <module> print(format_nat_rule.format(rule, srcdests[0], tran_addr, interface)) IndexError: list index out of range Rule Source Translation Outbound Interface ---- ------ ----------- ------------------
To fix some of this issue I modified line 102-103 in show_nat_rules.py:
if 'port' in tran_addr_json: tran_addr += 'port ' + str(tran_addr_json['port'])
I think using
isinstance(tran_addr_json['port'],int)
to check for nodes in the loaded json structure is not the best way to do it, you need to check if the key exists before you access its value in the isinstance() function.
There are still things that don't show correctly, e.g. I have some rules with a translation address range:
rule 380 { description "web proxy cluster" destination { address 123.123.123.123 port https } inbound-interface any protocol tcp translation { address 192.168.4.81-192.168.4.83 port 8443 } }
which simply now shows as
Rule Destination Translation Inbound Interface ---- ----------- ----------- ----------------- 380 port 443 port 8443 123.123.123.123
Here's some details and errors.
Version: VyOS 1.4-rolling-202110292022 Release train: sagitta
user@firewall:~$ show nat destination rules Traceback (most recent call last): Rule Destination Translation Inbound Interface ---- ----------- ----------- ----------------- File "/usr/libexec/vyos/op_mode/show_nat_rules.py", line 102, in <module> if isinstance(tran_addr_json['port'],int): KeyError: 'port'
user@firewall:~$ show nat source rules Traceback (most recent call last): Rule Source Translation Outbound Interface ---- ------ ----------- ------------------ 102 10.102.0.0/16 masquerade eth2 File "/usr/libexec/vyos/op_mode/show_nat_rules.py", line 102, in <module> if isinstance(tran_addr_json['port'],int): KeyError: 'port'
It gives a different error when the translation port option is configured for both the source and destination nat:
vyos@vyos# run sh conf comm | grep nat set nat destination rule 100 description 'Regular destination NAT from external' set nat destination rule 100 destination port '3389' set nat destination rule 100 inbound-interface 'eth0' set nat destination rule 100 protocol 'tcp' set nat destination rule 100 translation address '192.0.2.40' set nat destination rule 100 translation port '80'
vyos@vyos# run sh nat destination rules Rule Destination Translation Inbound Interface ---- ----------- ----------- ----------------- Traceback (most recent call last): File "/usr/libexec/vyos/op_mode/show_nat_rules.py", line 103, in <module> tran_addr += 'port ' + tran_addr_json['port'] TypeError: can only concatenate str (not "int") to str
For SNAT, if the translation address is configured to "masquerade" then the error is not seen.
vyos@vyos# run sh nat source rules Rule Source Translation Outbound Interface ---- ------ ----------- ------------------ 110 192.0.2.0/24 masquerade eth1
PR https://github.com/vyos/vyos-1x/pull/1114
vyos@r11-roll:~$ show nat destination rules Rule Destination Translation Inbound Interface ---- ----------- ----------- ----------------- 100 port 3389 192.0.2.40 port 80 eth0 vyos@r11-roll:~$
There is still another bug:
set nat destination rule 120 destination address '203.0.113.1' set nat destination rule 120 inbound-interface 'eth0' set nat destination rule 120 protocol 'tcp' set nat destination rule 120 translation address '192.0.2.40'
Show:
vyos@r11-roll:~$ show nat destination rules Traceback (most recent call last): File "/usr/libexec/vyos/op_mode/show_nat_rules.py", line 102, in <module> if isinstance(tran_addr_json['port'],int): Rule Destination Translation Inbound Interface ---- ----------- ----------- ----------------- KeyError: 'port' vyos@r11-roll:~$
Error still present on VyOS 1.4-rolling-202201020317
vyos@vyos:~$ show nat source rules Traceback (most recent call last): File "/usr/libexec/vyos/op_mode/show_nat_rules.py", line 114, in <module> print(format_nat_rule.format(rule, srcdests[0], tran_addr, interface)) IndexError: list index out of range Rule Source Translation Outbound Interface ---- ------ ----------- ------------------ vyos@vyos:~$ show ver Version: VyOS 1.4-rolling-202201020317 Release train: sagitta
Nat config in this example:
vyos@vyos:~$ show config comm | grep nat set nat source rule 10 description 'Masquerade to NAT' set nat source rule 10 outbound-interface 'eth0' set nat source rule 10 translation address 'masquerade'
Hello, sorry I haven't come up for a long time, I even changed the main system to gentoo in the process, can I still encounter this problem now
Still present in VyOS 1.4-rolling-202207160217.
Seems to occur when no source address is given on the SNAT rule.
I get the error with the following config:
set nat source rule 10 description 'Masquerade to NAT' set nat source rule 10 outbound-interface 'eth0' set nat source rule 10 translation address 'masquerade'
vyos@vyos:~$ show nat source rules Rule Source Translation Outbound Interface ---- ------ ----------- ------------------ Traceback (most recent call last): File "/usr/libexec/vyos/op_mode/show_nat_rules.py", line 114, in <module> print(format_nat_rule.format(rule, srcdests[0], tran_addr, interface)) IndexError: list index out of range
But get correct output with the following config:
set nat source rule 10 description 'Masquerade to NAT' set nat source rule 10 outbound-interface 'eth0' set nat source rule 10 source address '172.16.0.0/24' set nat source rule 10 translation address 'masquerade'
vyos@vyos:~$ show nat source rules Rule Source Translation Outbound Interface ---- ------ ----------- ------------------ 10 172.16.0.0/24 masquerade eth0
PR https://github.com/vyos/vyos-1x/pull/1417
set nat destination rule 120 destination address '203.0.113.1' set nat destination rule 120 inbound-interface 'eth0' set nat destination rule 120 protocol 'tcp' set nat destination rule 120 translation address '192.0.2.40' set nat source rule 10 description 'Masquerade to NAT' set nat source rule 10 outbound-interface 'eth0' set nat source rule 10 translation address 'masquerade'
Show nat:
vyos@r14# run show nat destination rules Rule Destination Translation Inbound Interface ---- ----------- ----------- ----------------- 120 tcp 192.0.2.40 eth0 203.0.113.1 [edit] vyos@r14# [edit] vyos@r14# run show nat source rules Rule Source Translation Outbound Interface ---- ------ ----------- ------------------ 10 any masquerade eth0 [edit] vyos@r14#
Confirmed to work correctly on version VyOS 1.4-rolling-202207180802.
set nat source rule 10 description 'Masquerade to NAT' set nat source rule 10 outbound-interface 'eth0' set nat source rule 10 translation address 'masquerade'
Results in:
vyos@vyos:~$ show nat source rules Rule Source Translation Outbound Interface ---- ------ ----------- ------------------ 10 any masquerade eth0
And for destination NAT rule of @Viacheslav:
set nat destination rule 120 destination address '203.0.113.1' set nat destination rule 120 inbound-interface 'eth0' set nat destination rule 120 protocol 'tcp' set nat destination rule 120 translation address '192.0.2.40'
vyos@vyos:~$ show nat destination rules Rule Destination Translation Inbound Interface ---- ----------- ----------- ----------------- 120 tcp 192.0.2.40 eth0 203.0.113.1