Page MenuHomeVyOS Platform

NAT: "show nat source rules" fails with KeyError: 'prefix'
Open, HighPublicBUG

Description

Executing the following operational command results in a Python traceback instead of displaying the configured source NAT rules:

show nat source rules

Actual Behavior

The command terminates with the following exception:

File "/usr/libexec/vyos/op_mode/nat.py", line 173, in _get_formatted_output_rules

saddr = f'{op}{my_dict["prefix"]["addr"]}/{my_dict["prefix"]["len"]}'

KeyError: 'prefix'

Expected Behavior

The command should successfully display all configured source NAT rules without throwing an exception.

Technical Details

The exception occurs in vyos/op_mode/nat.py, inside the _get_formatted_output_rules() function.

The code attempts to access the prefix key in my_dict, but this key is missing from the dictionary returned for at least one NAT rule.

This suggests that the output formatter does not correctly handle all possible NAT rule configurations or address representations.

Suggested Fix

Review the handling of NAT rule address fields in _get_formatted_output_rules() and ensure that missing or alternative address representations are handled gracefully.

Impact

The operational command for displaying source NAT rules fails completely when encountering a rule without the expected prefix dictionary entry.

Details

Version
VyOS 2026.11.07-0015-rolling
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)