Merge pull request #1112 from vyos/revert-1111-nat_interfaces_group

Revert "NAT: add interface-group documentation. "

1 files changed, 43 insertions, 65 deletions

diff --git a/docs/configuration/nat/nat44.rst b/docs/configuration/nat/nat44.rst
index 9c1d1423..c660f8f4 100644
--- a/docs/configuration/nat/nat44.rst
+++ b/docs/configuration/nat/nat44.rst
@@ -148,35 +148,23 @@ rule.
 
 * **outbound-interface** - applicable only to :ref:`source-nat`. It
   configures the interface which is used for the outside traffic that
-  this translation rule applies to. Interface groups, inverted
-  selection and wildcard, are also supported.
+  this translation rule applies to.
 
-  Examples:
+  Example:
 
   .. code-block:: none
 
-    set nat source rule 20 outbound-interface interface-name eth0
-    set nat source rule 30 outbound-interface interface-name bond1*
-    set nat source rule 20 outbound-interface interface-name !vtun2
-    set nat source rule 20 outbound-interface interface-group GROUP1
-    set nat source rule 20 outbound-interface interface-group !GROUP2
-
+    set nat source rule 20 outbound-interface eth0
 
 * **inbound-interface** - applicable only to :ref:`destination-nat`. It
   configures the interface which is used for the inside traffic the
-  translation rule applies to. Interface groups, inverted
-  selection and wildcard, are also supported.
+  translation rule applies to.
 
   Example:
 
   .. code-block:: none
 
-    set nat destination rule 20 inbound-interface interface-name eth0
-    set nat destination rule 30 inbound-interface interface-name bond1*
-    set nat destination rule 20 inbound-interface interface-name !vtun2
-    set nat destination rule 20 inbound-interface interface-group GROUP1
-    set nat destination rule 20 inbound-interface interface-group !GROUP2
-
+    set nat destination rule 20 inbound-interface eth1
 
 * **protocol** - specify which types of protocols this translation rule
   applies to. Only packets matching the specified protocol are NATed.
@@ -335,7 +323,7 @@ demonstrate the following configuration:
 
 .. code-block:: none
 
-  set nat source rule 100 outbound-interface interface-name 'eth0'
+  set nat source rule 100 outbound-interface 'eth0'
   set nat source rule 100 source address '192.168.0.0/24'
   set nat source rule 100 translation address 'masquerade'
 
@@ -344,9 +332,7 @@ Which generates the following configuration:
 .. code-block:: none
 
   rule 100 {
-      outbound-interface {
-          interface-name eth0
-      }
+      outbound-interface eth0
       source {
           address 192.168.0.0/24
       }
@@ -438,19 +424,19 @@ Example:
 
   set nat destination rule 100 description 'Regular destination NAT from external'
   set nat destination rule 100 destination port '3389'
-  set nat destination rule 100 inbound-interface interface-name 'pppoe0'
+  set nat destination rule 100 inbound-interface 'pppoe0'
   set nat destination rule 100 protocol 'tcp'
   set nat destination rule 100 translation address '192.0.2.40'
 
   set nat destination rule 110 description 'NAT Reflection: INSIDE'
   set nat destination rule 110 destination port '3389'
-  set nat destination rule 110 inbound-interface interface-name 'eth0.10'
+  set nat destination rule 110 inbound-interface 'eth0.10'
   set nat destination rule 110 protocol 'tcp'
   set nat destination rule 110 translation address '192.0.2.40'
 
   set nat source rule 110 description 'NAT Reflection: INSIDE'
   set nat source rule 110 destination address '192.0.2.0/24'
-  set nat source rule 110 outbound-interface interface-name 'eth0.10'
+  set nat source rule 110 outbound-interface 'eth0.10'
   set nat source rule 110 protocol 'tcp'
   set nat source rule 110 source address '192.0.2.0/24'
   set nat source rule 110 translation address 'masquerade'
@@ -466,9 +452,7 @@ Which results in a configuration of:
            destination {
                port 3389
            }
-           inbound-interface {
-               interface-name pppoe0
-           }
+           inbound-interface pppoe0
            protocol tcp
            translation {
                address 192.0.2.40
@@ -479,9 +463,7 @@ Which results in a configuration of:
            destination {
                port 3389
            }
-           inbound-interface {
-               interface-name eth0.10
-           }
+           inbound-interface eth0.10
            protocol tcp
            translation {
                address 192.0.2.40
@@ -494,9 +476,7 @@ Which results in a configuration of:
            destination {
                address 192.0.2.0/24
            }
-           outbound-interface {
-               interface-name eth0.10
-           }
+           outbound-interface eth0.10
            protocol tcp
            source {
                address 192.0.2.0/24
@@ -535,7 +515,7 @@ Our configuration commands would be:
 
   set nat destination rule 10 description 'Port Forward: HTTP to 192.168.0.100'
   set nat destination rule 10 destination port '80'
-  set nat destination rule 10 inbound-interface interface-name 'eth0'
+  set nat destination rule 10 inbound-interface 'eth0'
   set nat destination rule 10 protocol 'tcp'
   set nat destination rule 10 translation address '192.168.0.100'
 
@@ -550,9 +530,7 @@ Which would generate the following NAT destination configuration:
               destination {
                   port 80
               }
-              inbound-interface {
-                  interface-name eth0
-              }
+              inbound-interface eth0
               protocol tcp
               translation {
                   address 192.168.0.100
@@ -568,45 +546,43 @@ Which would generate the following NAT destination configuration:
 This establishes our Port Forward rule, but if we created a firewall
 policy it will likely block the traffic.
 
-Firewall rules for Destination NAT
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-It is important to note that when creating firewall rules, the DNAT
+It is important to note that when creating firewall rules that the DNAT
 translation occurs **before** traffic traverses the firewall. In other
 words, the destination address has already been translated to
 192.168.0.100.
 
-So in our firewall ruleset, we want to allow traffic which previously matched
-a destination nat rule. In order to avoid creating many rules, one for each
-destination nat rule, we can accept all **'dnat'** connections with one simple
-rule, using ``connection-status`` matcher:
+So in our firewall policy, we want to allow traffic coming in on the
+outside interface, destined for TCP port 80 and the IP address of
+192.168.0.100.
 
 .. code-block:: none
 
-  set firewall ipv4 forward filter rule 10 action accept
-  set firewall ipv4 forward filter rule 10 connection-status nat destination
-  set firewall ipv4 forward filter rule 10 state new enable
+  set firewall name OUTSIDE-IN rule 20 action 'accept'
+  set firewall name OUTSIDE-IN rule 20 destination address '192.168.0.100'
+  set firewall name OUTSIDE-IN rule 20 destination port '80'
+  set firewall name OUTSIDE-IN rule 20 protocol 'tcp'
+  set firewall name OUTSIDE-IN rule 20 state new 'enable'
 
 This would generate the following configuration:
 
 .. code-block:: none
 
-  ipv4 {
-      forward {
-          filter {
-              rule 10 {
-                  action accept
-                  connection-status {
-                      nat destination
-                  }
-                  state {
-                      new enable
-                  }
-              }
-          }
+  rule 20 {
+      action accept
+      destination {
+          address 192.168.0.100
+          port 80
+      }
+      protocol tcp
+      state {
+          new enable
       }
   }
 
+.. note::
+
+  If you have configured the `INSIDE-OUT` policy, you will need to add
+  additional rules to permit inbound NAT traffic.
 
 1-to-1 NAT
 ----------
@@ -634,10 +610,10 @@ and one external interface:
   set interfaces ethernet eth1 description 'Outside interface'
   set nat destination rule 2000 description '1-to-1 NAT example'
   set nat destination rule 2000 destination address '192.0.2.30'
-  set nat destination rule 2000 inbound-interface interface-name 'eth1'
+  set nat destination rule 2000 inbound-interface 'eth1'
   set nat destination rule 2000 translation address '192.168.1.10'
   set nat source rule 2000 description '1-to-1 NAT example'
-  set nat source rule 2000 outbound-interface interface-name 'eth1'
+  set nat source rule 2000 outbound-interface 'eth1'
   set nat source rule 2000 source address '192.168.1.10'
   set nat source rule 2000 translation address '192.0.2.30'
 
@@ -663,7 +639,7 @@ We will use source and destination address for hash generation.
 
 .. code-block:: none
 
-  set nat destination rule 10 inbound-interface inbound-interface eth0
+  set nat destination rule 10 inbound-interface eth0
   set nat destination rule 10 protocol tcp
   set nat destination rule 10 destination port 80
   set nat destination rule 10 load-balance hash source-address
@@ -679,7 +655,7 @@ We will generate the hash randomly.
 
 .. code-block:: none
 
-  set nat source rule 10 outbound-interface interface-name eth0
+  set nat source rule 10 outbound-interface eth0
   set nat source rule 10 source address 10.0.0.0/8
   set nat source rule 10 load-balance hash random
   set nat source rule 10 load-balance backend 192.0.2.251 weight 33
@@ -733,10 +709,12 @@ NAT Configuration
 
   set nat source rule 110 description 'Internal to ASP'
   set nat source rule 110 destination address '172.27.1.0/24'
+  set nat source rule 110 outbound-interface 'any'
   set nat source rule 110 source address '192.168.43.0/24'
   set nat source rule 110 translation address '172.29.41.89'
   set nat source rule 120 description 'Internal to ASP'
   set nat source rule 120 destination address '10.125.0.0/16'
+  set nat source rule 120 outbound-interface 'any'
   set nat source rule 120 source address '192.168.43.0/24'
   set nat source rule 120 translation address '172.29.41.89'