Do packets routed to another interface using
route-tooption on macOS actually pass the given interface?
I've read that
pf's firewall rules only applies to packets that (physically) pass the given interface. Thus, rules for a gateway's external interface will not apply to packets entering on the local interface and destined for the external interface, since the TCP/IP stack handles such packets internally.
Thus, do packets that are
route-to (filter rule) another interface on the gateway pass that interface, so that the interface's rules will apply to the packet?
Here is the documentation from the OSX man page:
route-to The route-to option routes the packet to the specified interface with an optional address for the next hop. When a route-to rule creates state, only packets that pass in the same direction as the filter rule specifies will be routed in this way. Packets passing in the opposite direction (replies) are not affected and are routed normally.