From owner-freebsd-pf@FreeBSD.ORG Sun Dec 11 11:18:54 2005 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E7EC616A41F for ; Sun, 11 Dec 2005 11:18:54 +0000 (GMT) (envelope-from solinym@gmail.com) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.195]) by mx1.FreeBSD.org (Postfix) with ESMTP id 48E4D43D8F for ; Sun, 11 Dec 2005 11:18:53 +0000 (GMT) (envelope-from solinym@gmail.com) Received: by wproxy.gmail.com with SMTP id i14so1526604wra for ; Sun, 11 Dec 2005 03:18:52 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=SzJ/0gbm1GSecBtfJwVUzzJAAnmikqWTDrOjLhzd8GNODpZJDnShTaani0oT5wo+GGXtjMqfn0ZYIcFF1Lf+llGKgSejBqZgoMo8h0mlhvqs/IKTBGLt0QOHCxE2BHFsZQkfzeSMuSDCs+GtKUvD0AMcV7jgXtfMSZGBM08dl2o= Received: by 10.54.133.7 with SMTP id g7mr1502167wrd; Sun, 11 Dec 2005 03:18:52 -0800 (PST) Received: by 10.54.78.20 with HTTP; Sun, 11 Dec 2005 03:18:52 -0800 (PST) Message-ID: Date: Sun, 11 Dec 2005 05:18:52 -0600 From: "Travis H." To: yayj In-Reply-To: <439A5545.1090308@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline References: <439A5545.1090308@gmail.com> Cc: freebsd-pf@freebsd.org Subject: Re: My problem of pf rule X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 11 Dec 2005 11:18:55 -0000 > let's put aside the subnet routing env.s the int are in and the routing > table of host is like this, if the dest IP of packet is in then > it's forwarded to em0, if is in then em1. I turn on NAT on em0. > > there are two questions left: > 1. I wanna employ a flow control for the two fxp int on em0 other than. > cuz NAT is applying on em0, I can't describe the flow of the two fxp int > using 'on em0' respectively. I describe them on their source int like thi= s: > > pass in on fxp0 inet from to queue queue0 > pass in on fxp0 inet from to queue queue1 What's "a flow control"? I don't see why you can't specify "on em0", even when NAT is in use. > 2. The host itself may also send data by em0 using the IP of em0, how > can I describe this flow? Using cbq(default) or whatever? How about: pass out on em0 from (em0) to any This notation for use with dynamic IPs is described in the FAQ: http://www.openbsd.org/faq/pf/ -- http://www.lightconsulting.com/~travis/ -><- Knight of the Lambda Calculus "We already have enough fast, insecure systems." -- Schneier & Ferguson GPG fingerprint: 50A1 15C5 A9DE 23B9 ED98 C93E 38E9 204A 94C2 641B