Hi all
pf has rules that can operate either 'in' or 'out'. That is, on traffic
entering or leaving an interface. I'm trying to consolidate my rules to
make them easier to understand and update, so it seems a bit pointless
to have the same rules twice.
Are there any best practices on whether it makes more sense to put rules
on the in or out side? I could bind all the rules to the internet facing
interface and then use "in" for inbound traffic and "out" for outbound.
Does that makes sense? Does it make any difference from a performance
point of view?
Secondly, where do DNAT rules execute in the sequence? Do they change
the destination IP in between the in and out pass pf rules?
I'm not currently subscribed here, so please cc me on replies.
Thanks
Ari
_______________________________________________
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"
