[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
rdr vs pass
Could someone please settle a debate I am having at work? I admit to being old school, having started on IPF with obsd 2.6, now I am running PF on 3.5. My co-worker has been learning pf over the past year. I guess the debate is, he thinks pass/block filter rules are redundant and want to only use redirects, such as:rdr from $oneIP to $anotherInternalIP port whatever.
I tend to think that:
pass in on fxp0 from $oneIP to $anotherIP port whatever; and
block in on fxp0 from any to $anotherInteralIP port whatever
seems like if everything could be done with redirects, why did the gods of openbsd create rules? The only real argument I have is rules buy us logging....ah, assuming somebody is looking at the logs of course.
What is the opinion of the list?
--ja
--