From owner-freebsd-questions@FreeBSD.ORG Fri Aug 27 18:09:21 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 975851065672 for ; Fri, 27 Aug 2010 18:09:21 +0000 (UTC) (envelope-from bc979@lafn.org) Received: from zoom.lafn.org (zoom.lafn.org [206.117.18.8]) by mx1.freebsd.org (Postfix) with ESMTP id 79C468FC17 for ; Fri, 27 Aug 2010 18:09:21 +0000 (UTC) Received: from [10.0.1.4] (pool-71-109-159-124.lsanca.dsl-w.verizon.net [71.109.159.124]) (authenticated bits=0) by zoom.lafn.org (8.14.3/8.14.2) with ESMTP id o7RI9Ggo047470 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Fri, 27 Aug 2010 11:09:17 -0700 (PDT) (envelope-from bc979@lafn.org) References: <96E6F9A3-49F5-4C55-8248-6D62717636DF@lafn.org> <20100827140713.41391a3e@davenulle.org> In-Reply-To: <20100827140713.41391a3e@davenulle.org> Mime-Version: 1.0 (Apple Message framework v1081) Content-Type: text/plain; charset=iso-8859-1 Message-Id: <2D2B914E-B6FA-43CF-9741-559D74D43B9E@lafn.org> Content-Transfer-Encoding: quoted-printable From: Doug Hardie Date: Fri, 27 Aug 2010 11:09:16 -0700 To: Patrick Lamaiziere X-Mailer: Apple Mail (2.1081) X-Virus-Scanned: clamav-milter 0.95.3 at zoom.lafn.org X-Virus-Status: Clean Cc: freebsd-questions@freebsd.org Subject: Re: Routing Question X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Aug 2010 18:09:21 -0000 On 27 August 2010, at 05:07, Patrick Lamaiziere wrote: > Le Thu, 26 Aug 2010 18:17:19 -0700, > Doug Hardie a =E9crit : >=20 >> PF's route_to will return the packets to the proper router, but I = have not >> been able to figure out which ones those would be. The source IP >> address can be any on either network and its highly likely that we >> will see packets from the same source network on both at the same >> time. The only distinction I see in the input packets between the >> two paths is the MAC address of the router. I don't see any way in >> pf or the system to use that to affect the return path >> though. >=20 > the filter option "reply-to" looks to be what you need. It works by > keeping the state of a connection (see pf.conf(5)). That works great on the output if you can figure out which packets to = use it on. The only way I can see to separate the traffic is using the = router MAC address. I don't find anything in pf that will look at that.=