Re: bi-nat biavior and anchor limitation

2012-09-14 Thread Stuart Henderson
On 2012-09-13, Michel Blais mic...@targointernet.com wrote: Hi, I just encounter a stange biavior with the bi-nat rules. Since we optimize our firewall script via multiple anchor for our thousand of bi-nat rule, we don't use the bi-nat rule but instead use the 2 rules in different anchor.

bi-nat biavior and anchor limitation

2012-09-13 Thread Michel Blais
Hi, I just encounter a stange biavior with the bi-nat rules. Since we optimize our firewall script via multiple anchor for our thousand of bi-nat rule, we don't use the bi-nat rule but instead use the 2 rules in different anchor. Exemple: anchor out on $ext_if from 192.168.0.0/16 { anchor

Re: bi-nat biavior and anchor limitation

2012-09-13 Thread Michel Blais
Le 2012-09-13 11:34, Michel Blais a écrit : Also, is it a pfctl limitation to not be able to use it on anchor inside a other anchor or I'm missing something ? Exemple, I load a anchor in main ruleset named A and in A, I load a other anchor named B. Is there any way to use pfctl on B anchor ?