Re: PF Natting before filtering

2020-09-21 Thread Stuart Henderson
On 2020-09-21, open...@kene.nu wrote: >> > My basic ruleset snippet: >> > pass quick on vlan100 from any to any >> > match out on vlan200 nat-to vlan200 >> > pass out on vlan200 >> > block out quick on vlan200 from >> >> If this is your actual ruleset, you are observing the intended behavior. >>

Re: PF Natting before filtering

2020-09-21 Thread Peter N. M. Hansteen
On Mon, Sep 21, 2020 at 02:14:25PM +0200, open...@kene.nu wrote: > > > can find online seems to suggest otherwise. > > > > It would be interesting to hear which shreds of information you found. > > > Mainly this which I see now contradicts itself. > https://forums.freebsd.org/threads/nat-filtering-

Re: PF Natting before filtering

2020-09-21 Thread openbsd
On Mon, Sep 21, 2020 at 1:39 PM Peter N. M. Hansteen wrote: > On Mon, Sep 21, 2020 at 12:46:15PM +0200, open...@kene.nu wrote: > > > I am seeing what could be expected behaviour but the small shreds of > info I > > can find online seems to suggest otherwise. > > It would be interesting to hear wh

Re: PF Natting before filtering

2020-09-21 Thread Peter N. M. Hansteen
On Mon, Sep 21, 2020 at 12:46:15PM +0200, open...@kene.nu wrote: > I am seeing what could be expected behaviour but the small shreds of info I > can find online seems to suggest otherwise. It would be interesting to hear which shreds of information you found. > > I have a box that acts as a ro

PF Natting before filtering

2020-09-21 Thread openbsd
Hello, I am seeing what could be expected behaviour but the small shreds of info I can find online seems to suggest otherwise. I have a box that acts as a router and firewall. It forwards packets from the internal lan (call it vlan100) and sends it natted out on the external lan (call it vlan200)