weirdness with binat on multiple interfaces (4.7 and August 9th snapshot)

2010-08-13 Thread Dan Weber
If you pass multiple interfaces to a binat-to rule, internally pfctl generates n^2/2 rules: # echo pass on {a, b, c, d, e, f, g } binat-to 1.2.3.4 | pfctl -a test -f- # pfctl -a test -sr pass out on a inet all flags S/SA keep state nat-to 1.2.3.4 static-port pass in on a inet from any to 1.2.3.4

using nat-to and divert-packet together

2010-01-25 Thread Dan Weber
Hi, I'm using the Jan 20 snapshot, although I got similar results using a snapshot from late October. I'm trying to use divert-packet to grab NAT'd packets, analyze them in a user-space program, and then put them back into the stack. Here is my pf.conf (with ext_if and divport defined