Re: PF and "route-to"

[Daniel Hartmeier <daniel@benzedrine.cx>]

On Thu, Jun 06, 2002 at 05:40:44PM -0600, Luis Cerdas wrote:

> The thing is that pf is in fact routing to the configured interface (rule
> matching is working), and is forwarding to the next hop router, but it is
> not doing any NAT for the packet.

Yes, route-to (as well as fastroute and dup-to) will send packets out
directly through the interface, without going through pf again. Hence,
NAT on the outgoing interface doesn't work (neither would filter rules
on the outgoing interface apply to such packets).

It would be possible to force them through pf again, but I'm not yet
sure how this can be done with minimal overhead. For now, I'll just note
that it doesn't work.

Daniel