0

Do packets routed to another interface using pf's route-to option on macOS actually pass the given interface?

I've read that pf's firewall rules only applies to packets that (physically) pass the given interface. Thus, rules for a gateway's external interface will not apply to packets entering on the local interface and destined for the external interface, since the TCP/IP stack handles such packets internally.

Thus, do packets that are route-to (filter rule) another interface on the gateway pass that interface, so that the interface's rules will apply to the packet?

Here is the documentation from the OSX man page:

 route-to
       The route-to option routes the packet to the specified interface with an optional address for the next hop.  When a route-to rule creates state, only packets that pass in the same direction as the filter
       rule specifies will be routed in this way.  Packets passing in the opposite direction (replies) are not affected and are routed normally.
  • The best way for you to verify this is to use a packet browser on your connections/interfaces. – Dakta Moriamé Jul 26 at 6:02
  • I've verified that rules apply, but does the reference say that? Maybe a high-skilled firewall guy can answer that. – Shuzheng Jul 26 at 6:20
  • You could answer it by yourself if you would sniff what passes on the wire. A little hint on a packet-tracer app: Wireshark (is the world’s foremost and widely-used network protocol analyzer) – Dakta Moriamé Jul 26 at 6:26
1

I've read that pf's firewall rules only applies to packets that (physically) pass the given interface.

I remember answering to your similar question on unix.stackexchange.com

Thus, rules for a gateway's external interface will not apply to packets entering on the local interface and destined for the external interface, since the TCP/IP stack handles such packets internally.

Pf's rules do apply to traffic over loopback too unless you're specifically exclude it with smth like set skip on lo0.

You also better keep in mind that Pf's version shipped with MacOS is severely outdated and some documented features of Pf don't work at all or work incorrectly. route-to is somewhat "hacky" feature and I won't be any surprised if it'd fail in similar ways.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .