What’s new in 7.4beta2 (2022-Jun-07 12:08)
*) firewall - properly handle interface matcher when VRF interface is specified;
Quick test with 7.4beta5 now shows:
firewall,info prerouting: in:guest out:(unknown 0), connection-state:new src-mac xx:xx:xx:xx:xx:xx, proto ICMP (type 8, code 0), 192.168.82.1->192.168.82.123, len 56
firewall,info prerouting: in:guest out:(unknown 0), connection-state:new src-mac xx:xx:xx:xx:xx:xx, proto ICMP (type 8, code 0), 192.168.82.1->192.168.82.123, len 56
firewall,info input: in:guest out:(unknown 0), connection-state:new src-mac xx:xx:xx:xx:xx:xx, proto ICMP (type 8, code 0), 192.168.82.1->192.168.82.123, len 56
firewall,info output: in:(unknown 0) out:(unknown 1358), connection-state:established proto ICMP (type 0, code 0), 192.168.82.123->192.168.82.1, len 56
firewall,info postrouting: in:(unknown 0) out:(unknown 1358), connection-state:established proto ICMP (type 0, code 0), 192.168.82.123->192.168.82.1, len 56
firewall,info output: in:(unknown 0) out:guest, connection-state:established proto ICMP (type 0, code 0), 192.168.82.123->192.168.82.1, len 56
firewall,info postrouting: in:(unknown 1358) out:guest, connection-state:established proto ICMP (type 0, code 0), 192.168.82.123->192.168.82.1, len 56
So in-interface works (but in-interface-list doesn’t) and shows incoming interface as user would expect. Outgoing interface is still the hidden one. I also wonder if the same packet going through prerouting twice like this could cause any problems (I can’t say it does, it’s just a suspicion).