Firewall: DNAT: "disabled" and "ipprotocol" migrations

src/etc/inc/filter.lib.inc

@@ -644,7 +644,7 @@ function filter_core_rules_system($fw, $defaults)
 
     /* auto-generated DNAT rules */
     foreach ((new OPNsense\Firewall\DNat(false))->rule->sortedBy(['sequence']) as $key => $rule) {
-        if ($rule->disabled->isEmpty() && $rule->pass == 'rule') {
+        if (!$rule->enabled->isEmpty() && $rule->pass == 'rule') {
             $dnatrule = $rule->getNodeContent();
             $tmprule = [
                 'ipprotocol' =>  $dnatrule['ipprotocol'],

src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/DNatController.php

@@ -91,7 +91,7 @@ public function searchRuleAction()
                     'ipprotocol' => '', /* renders as asterisk */
                     'protocol' => 'tcp',
                     '%protocol' => 'TCP',
-                    'disabled' => '0',
+                    'enabled' => '1',
                     'nordr' => '1',
                     'interface' => $if,
                     '%interface' => $ifname,
@@ -140,26 +140,9 @@ public function delRuleAction($uuid)
         return $this->delBase("rule", $uuid);
     }
 
-    /**
-     * opposite toggle (disable instead of enable)
-     */
-    public function toggleRuleAction($uuid, $disabled = null)
+    public function toggleRuleAction($uuid, $enabled = null)
     {
-        $result = ['result' => 'failed'];
-        if ($this->request->isPost() && $uuid != null) {
-            Config::getInstance()->lock();
-            $node = $this->getModel()->getNodeByReference('rule.' . $uuid);
-            if ($node != null) {
-                if (in_array($disabled, ['0', '1'])) {
-                    $node->disabled = (string)$disabled;
-                } else {
-                    $node->disabled = (string)$node->disabled == '1' ? '0' : '1';
-                }
-                $result['result'] = $node->disabled->isEmpty() ? 'Enabled' : 'Disabled';
-                $this->save(false, true);
-            }
-        }
-        return $result;
+        return $this->toggleBase("rule", $uuid, $enabled);
     }
 
     public function moveRuleBeforeAction($selected_uuid, $target_uuid)

src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogDNatRule.xml

@@ -4,10 +4,10 @@
         <label>Organization</label>
     </field>
     <field>
-        <id>rule.disabled</id>
-        <label>Disabled</label>
+        <id>rule.enabled</id>
+        <label>Enabled</label>
         <type>checkbox</type>
-        <help>Disable this rule so it will not be used.</help>
+        <help>Enable this rule.</help>
         <grid_view>
             <type>boolean</type>
             <formatter>rowtoggle</formatter>
@@ -77,7 +77,7 @@
         <id>rule.ipprotocol</id>
         <label>Version</label>
         <type>dropdown</type>
-        <help>Select IPv4, IPv6 or both.</help>
+        <help>Select IPv4 or IPv6</help>
         <grid_view>
             <formatter>any</formatter>
             <sequence>30</sequence>

src/opnsense/mvc/app/models/OPNsense/Firewall/DNat.xml

@@ -11,7 +11,9 @@
                 <Required>Y</Required>
                 <!-- Intentionally no default set as its applied by actionPostLoadingEvent() -->
             </sequence>
+            <!-- legacy disabled flag for compatibility -->
             <disabled type="BooleanField"/>
+            <enabled type=".\DNatEnabledField" volatile="true"/>
             <nordr type="BooleanField"/>
             <interface type="InterfaceField">
                 <Multiple>Y</Multiple>
@@ -27,7 +29,6 @@
                 <OptionValues>
                     <inet>IPv4</inet>
                     <inet6>IPv6</inet6>
-                    <inet46>IPv4+IPv6</inet46>
                 </OptionValues>
                 <BlankDesc>any</BlankDesc>
             </ipprotocol>

src/opnsense/mvc/app/models/OPNsense/Firewall/FieldTypes/DNatEnabledField.php

@@ -0,0 +1,54 @@
+<?php
+
+/*
+ * Copyright (C) 2026 Deciso B.V.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Firewall\FieldTypes;
+
+use OPNsense\Base\FieldTypes\BooleanField;
+
+class DNatEnabledField extends BooleanField
+{
+    public function setValue($value)
+    {
+        if ($value === null) {
+            return;
+        }
+        $value = (string)$value;
+        // Set disabled value opposite of enabled value for legacy compatibility.
+        $this->getParentNode()->disabled = $value === '1' ? '0' : '1';
+        return parent::setValue($value);
+    }
+
+    public function getValue(): string
+    {
+        $parent = $this->getParentNode();
+        if ($parent !== null && isset($parent->disabled)) {
+            return (string)$parent->disabled === '1' ? '0' : '1';
+        }
+        return parent::getValue();
+    }
+}

src/opnsense/mvc/app/models/OPNsense/Firewall/Migrations/MFP1_0_5.php

@@ -0,0 +1,48 @@
+<?php
+
+/*
+ * Copyright (C) 2026 Deciso B.V.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Firewall\Migrations;
+
+use OPNsense\Base\BaseModelMigration;
+use OPNsense\Core\Config;
+use OPNsense\Firewall\Filter;
+
+class MFP1_0_5 extends BaseModelMigration
+{
+	public function run($model)
+	{
+		$cfgObj = Config::getInstance()->object();
+		if ($model instanceof Filter && isset($cfgObj->nat->rule)) {
+			foreach ($cfgObj->nat->rule as $rule) {
+				if ((string)$rule->ipprotocol === 'inet46') {
+					$rule->ipprotocol = '';
+				}
+			}
+		}
+	}
+}

src/opnsense/mvc/app/views/OPNsense/Firewall/nat_rule.volt

@@ -192,11 +192,7 @@
                     const data = row.getData();
                     const $element = $(row.getElement());
 
-                    // XXX: d_nat model provides a disabled key
-                    if (
-                        ('enabled' in data && data.enabled == "0") ||
-                        ('disabled' in data && data.disabled == "1")
-                    ) {
+                    if ('enabled' in data && data.enabled == "0") {
                         $element.addClass('row-disabled');
                     }
 
@@ -299,10 +295,7 @@
                         if (row.isGroup || !rowId.includes('-')) {
                             return '';
                         }
-                        const isEnabled =
-                            entrypoint === 'd_nat'  /* flag is inverted in model */
-                                ? row[column.id] === "0"
-                                : row[column.id] === "1";
+                        const isEnabled = row[column.id] === "1";
                         return `
                             <span class="fa fa-fw ${isEnabled ? 'fa-check-square-o' : 'fa-square-o text-muted'} bootgrid-tooltip command-toggle"
                                 style="cursor: pointer;"