View Single Post
  #3   (View Single Post)  
Old 1st May 2009
J65nko J65nko is offline
Administrator
 
Join Date: May 2008
Location: Budel - the Netherlands
Posts: 4,131
Default

This behaviour is clearly documented in the pf man page
Code:
TRANSLATION
     Translation rules modify either the source or destination address of the
     packets associated with a stateful connection.  A stateful connection is
     automatically created to track packets matching such a rule as long as
     they are not blocked by the filtering section of pf.conf.  The transla-
     tion engine modifies the specified address and/or port in the packet, re-
     calculates IP, TCP and UDP checksums as necessary, and passes it to the
     packet filter for evaluation.

     Since translation occurs before filtering the filter engine will see
     packets as they look after any addresses and ports have been translated.
     Filter rules will therefore have to filter based on the translated ad-
     dress and port number.  Packets that match a translation rule are only
     automatically passed if the pass modifier is given, otherwise they are
     still subject to block and pass rules.

     The state entry created permits pf(4) to keep track of the original ad-
     dress for traffic associated with that state and correctly direct return
     traffic for that connection.
__________________
You don't need to be a genius to debug a pf.conf firewall ruleset, you just need the guts to run tcpdump
Reply With Quote