Re: pf multiple match rules

2014-05-07 Thread Marko Cupać
Thank you for reply. I have been trying some trial and error tests, and I came to similar conclusion, but I would like to understand the design idea behind match rule. Who wins, the first or the last matching rule? Or do they all stick together? What if they are conflicting, like in this case?

Re: pf multiple match rules

2014-05-07 Thread Blaise Hizded
On 05/07/2014 12:17 PM, Marko Cupać wrote: Thank you for reply. I have been trying some trial and error tests, and I came to similar conclusion, but I would like to understand the design idea behind match rule. Who wins, the first or the last matching rule? Or do they all stick together?

Re: pf multiple match rules

2014-05-07 Thread Marko Cupać
On Wed, 07 May 2014 12:23:12 +0200 Blaise Hizded bla...@ovh.fr wrote: As Henning Brauer said, the rewrite are applied immediately. So the first match rule will rewrite IP from the packet and the second match will be evaluated on the new IP rewritten. There is no win, the packet is passed thru

Re: pf multiple match rules

2014-05-07 Thread Blaise Hizded
On 05/07/2014 12:41 PM, Marko Cupać wrote: On Wed, 07 May 2014 12:23:12 +0200 Blaise Hizded bla...@ovh.fr wrote: As Henning Brauer said, the rewrite are applied immediately. So the first match rule will rewrite IP from the packet and the second match will be evaluated on the new IP

pf multiple match rules

2014-05-06 Thread Marko Cupać
Hi, with the following two match lines: match out on $ext_if from 192.168.1.0/24 to any nat-to X.X.X.X match out on $ext_if from 192.168.1.55 to any nat-to Y.Y.Y.Y and the following pass line: pass in on $int_if inet proto tcp from 192.168.1.55 to any will the packets be translated to X.X.X.X

Re: pf multiple match rules

2014-05-06 Thread Blaise Hizded
On 05/06/2014 12:54 PM, Marko Cupać wrote: Hi, with the following two match lines: match out on $ext_if from 192.168.1.0/24 to any nat-to X.X.X.X match out on $ext_if from 192.168.1.55 to any nat-to Y.Y.Y.Y and the following pass line: pass in on $int_if inet proto tcp from 192.168.1.55

Re: pf multiple match rules

2014-05-06 Thread Henning Brauer
* Marko Cupać marko.cu...@mimar.rs [2014-05-06 12:55]: Hi, with the following two match lines: match out on $ext_if from 192.168.1.0/24 to any nat-to X.X.X.X match out on $ext_if from 192.168.1.55 to any nat-to Y.Y.Y.Y and the following pass line: pass in on $int_if inet proto tcp