NetBSD Problem Report #60538

From www@netbsd.org  Tue Aug  4 18:28:49 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id DE9331A923E
	for <gnats-bugs@gnats.NetBSD.org>; Tue,  4 Aug 2026 18:28:48 +0000 (UTC)
Message-Id: <20260804182847.7C34D1A923F@mollari.NetBSD.org>
Date: Tue,  4 Aug 2026 18:28:47 +0000 (UTC)
From: joe@ns1.eloisystems.com
Reply-To: joe@ns1.eloisystems.com
To: gnats-bugs@NetBSD.org
Subject: npf(7) port range not supported in NAT rules with no port mapping
X-Send-Pr-Version: www-1.0
X-From4GNATS: "joe@ns1.eloisystems.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60538
>Category:       bin
>Synopsis:       npf(7) port range not supported in NAT rules with no port mapping
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Aug 04 18:30:00 +0000 2026
>Originator:     Emmanuel
>Release:        NetBSD 11
>Organization:
NetBSD
>Environment:
NetBSD 11.0 (GENERIC64) #0: Thu Jul 30 15:23:12 UTC 2026  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/evbarm/compile/GENERIC64 evbarm
>Description:
In a situation where you have several services listening on different ports
and you want to apply static NAT rules (without changing port numbers) for those services to the internet via a single IP, 

It is very convenient to have a single translation where you specify a port range
to be used for those services and not writing several NAT rules for every single port.

NPF currently does not allow port ranges to be used in translation segment of NAT rules.

This should be supported for static NAT rules or dynamic rules with no-port flags set
since they do not have any business rewriting port numbers. if there be need to change ports,
 then it is free to disallow.
>How-To-Repeat:
map $ext_if static proto udp $ip <-> $ext_v4 port 7078 - 7083


>Fix:
Yes, please !

Home	PR Database Search