Chris Smith wrote:

quoted text
> On Wednesday 16 July 2008, Marco Fretz wrote:

>> pf nat rule:

>> nat log on bge0 inet from 172.16.12.128/27 tag natted -> 88.82.xx.xx

>>

>> pf filter rule:

>> pass log quick all flags S/SA keep state tagged natted

>

> FWIW, you no longer need to specify "flags S/SA keep state" as it is the

> default.

Yes, i know. It copied the rules out of "pfctl -sr" and there it is

shown because its added by default...
>

quoted text
> It does work here, or my packets would not end up in the proper queues.

> 

the difference i see to your construct is you'r tagging packets which

are already tagged. but anyways my construct should work as well, right?
at the moment i do nat and then a pass:
nat log on bge0 inet from 172.16.12.128/27 tag natted -> 88.82.xx.xx

pass log quick from 172.16.12.128/27
if i add the "tagged natted" to the pass rule the rule does never match...
>> the packed is dropped by my default deny rule (the rule does never

quoted text
>> match). i think the packet does not get the tag "natted". any ideas?

>> them same thing with rdr rules is woking fine.

>

>> nat and rdr is done before filtering, right? so if the connection

>> gets natted the tag should be present in the filter section...?

>> (thats what i read in the FAQ)

>

> The FAQ actually states "translation occurs before filtering", which may

> be interpreted differently than "nat and rdr is done before filtering".

>

> This construct is working for me:

> ==========================================================

> nat on $ext_if inet from $voip_if:network tag VOIP_NET_NAT tagged

> VOIP_NET -> ($ext_if)

>

> pass in on $voip_if inet proto { tcp, icmp, udp } all tag VOIP_NET

>

> pass out quick on $ext_if from ($ext_if) tagged VOIP_NET_NAT queue

> voip_out

> ==========================================================

>

> The packet arrives on the internal interface, $voip_if, and gets tagged

> with VOIP_NET, the nat rule tags everything that is tagged VOIP_NET

> with a new tag of VOIP_NET_NAT, then everything tagged VOIP_NET_NAT is

> passed quick out the external interface through the voip_out queue

> (highest priority).