[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

rdr vs pass



Could someone please settle a debate I am having at work?  I admit to being old school, having started on IPF with obsd 2.6, now I am running PF on 3.5.  My co-worker has been learning pf over the past year.  I guess the debate is, he thinks pass/block filter rules are redundant and want to only use redirects, such as:rdr from $oneIP to $anotherInternalIP port whatever.
I tend to think that:
pass in on fxp0 from $oneIP to $anotherIP port whatever; and
block in on fxp0 from any to $anotherInteralIP port whatever
seems like if everything could be done with redirects, why did the gods of openbsd create rules?  The only real argument I have is rules buy us logging....ah, assuming somebody is looking at the logs of course.

What is the opinion of the list?

--ja

--