The quick option can help you locate your error.
If you add a quick option to the third rule, and the platform at 192.168.50.2 no longer uses the proxy, there is a follow-on rule which matches this traffic, overriding the third rule. This is because the quick option is used to end further rule evaluation.
If the quick option does not change behavior, then there are two possibilities: 1) either the rule does not match the traffic, or, 2) you have a match rule in the ruleset that is setting the rdr-to option.
If you enable logging for your rules, you can use tcpdump(8) with pflog(4) to see exactly which rule is being applied to the traffic.
|