How to create NAT Port Forward with “Filter Rule Association” via pfSense REST API v2?

[TechAsen]

Does pfSense REST API v2 support creating a NAT port forward with Filter Rule Association (i.e. automatically generating and linking the firewall rule) just like the GUI option “Add associated filter rule”?

If so, how should the API request be structured?
If not, what is the recommended way to programmatically achieve the same behavior?

[anntnzrb]

Use associated_rule_id parameter. Values: "new" (auto-create filter rule), "pass" (pass without rule), "" (manual rule required). See Models/PortForward.inc lines 95-110.

[TechAsen]

Hi,
When creating a new Filter Rule Association via the API with the state set to disabled, the rule is displayed as active (enabled) in the Firewall Rules on the WAN interface.

In contrast, when creating the exact same rule through the GUI, the rule is correctly created in a disabled state in the Firewall Rules.

[TechAsen]

Hi,
I found the root cause of this bug and would like to propose a fix.

The issue is that when creating the associated firewall rule, the disabled value is not passed, which causes the rule to always be created as enabled, regardless of the Port Forward rule state.

The proposed fix is:
Models/PortForward.inc

• when creating a new firewall rule, explicitly pass the disabled value
• when updating an existing rule, synchronize disabled with the current Port Forward value

$firewall_rule = new FirewallRule( type: 'pass', interface: [$this->interface->value], ipprotocol: $this->ipprotocol->value, protocol: $this->protocol->value, source: $this->source->value, source_port: $this->source_port->value, destination: $this->target->value, destination_port: $this->local_port->value, descr: "Associated rule for port forward rule {$this->associated_rule_id->value}", client: $this->client, disabled: $this->disabled->value, // added );
and on update:

`if ($rule_q->exists()) {
$firewall_rule = $rule_q->first();
$firewall_rule->from_representation(
type: 'pass',
interface: [$this->interface->value],
ipprotocol: $this->ipprotocol->value,
protocol: $this->protocol->value,
source: $this->source->value,
source_port: $this->source_port->value,
destination: $this->target->value,
destination_port: $this->local_port->value,
);

// added
$firewall_rule->disabled->value = $this->disabled->value;`