Transparent bridge performance with PF

[northwoods]

I'm in the process of setting up a transparent bridge using PF but am having some problems determining which of the two bridged interfaces the filtering should occur on. The box has a total of three interface, one dedicated for management with the other two passing traffic through for users. Performance wise the interfaces gig-connected intel nics serving a couple hundred users but we wanted to implement some filtering to allow through only http, https, ect for guests and while it does work in it's current state I'm wondering if the inside interface was the best choice for the filtering to be conducted or if it would better to be filtering on the external interface.

Ideas?

[DutchDaemon]

I tend to filter on the interface closest to the users ('LAN side', so to speak) or on the bridge interface itself (for those who can't get off the fence ..). Filtering on the external interface ('WAN' side) is used for keeping the rest of the world out. That way, the bridge has a nice wall around all sides, with not much going on inside.

On a router it depends on whether there are services running on the router itself which the users may need (DNS, mail, DHCP, etc.).

[northwoods]

all services are to be passed through to users from the outside, nothing running on the box outside of the filtering.

[DutchDaemon]

Then I'd say: filter on the interface closest to where traffic originates from. So filter outbound LAN traffic on the LAN side, and inbound external traffic on the WAN side.