Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • That was it! I will have to remember that I can use tcp dump and do a packet capture rather than just reading the PF logs with it. Thanks! Commented Jul 27, 2022 at 2:29
  • @zé-loff, I am curious about why the second rule is necessary. Does not pf create state allowing reverse way from the first one across the entire device, not limited to the $ext-if ? Commented Jul 27, 2022 at 7:25
  • @BrahimGaabab yes, it does, but its a different interface, you have to explicitly allow it to go out on $int_if. The created states make it unnecessary to create pass out rules for the replies (i.e. out of $ext_if back to the client, and in $int_if from the server), but not for establishing the connections on both _ifs. Commented Jul 27, 2022 at 7:39
  • Thank you @zé-loff. I understand. Filtering in pf happens at interfaces rather on chains as in netfilter! Commented Jul 27, 2022 at 9:06