SOLVED: route-to being ignored?

[Jason DiCioccio]

OK.  I finally got this working..  Apparently you can't have a reply-to
rule along with an rdr rule.  I guess pf won't track state for both
filtering and rewriting at the same time.

Thanks!
-JD-

>> Jason DiCioccio wrote:
>>> Greetings,
>>>   I'm having a bit of an issue here with pf and the route-to statement
>>> on
>>> 6.1-RELEASE-p3/i386.
>>>
>>>
>>>   Basically, I have the following rule (at the top of my rules, no
>>> less):
>>>
>>> pass out quick route-to ( tun0 10.8.1.5 ) from 66.29.58.71/32 to any
>>>
>>>   I've tried this rule with keep state, without keep state, with quick,
>>> without quick, basically everything I could think of.  And I haven't
>>> been able to get this to do anything at all.  Traffic is still flowing
>>> out of ng0 (where the default route resides).
>>>
>>>   66.29.58.71 is an IP bound to lo0 on the server.  Traffic for it
>>> comes
>>> in over tun0, for which the ifconfig follows:
>>>
>>> tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
>>>         inet6 fe80::24a7:3207:1aa1:c985%tun0 prefixlen 64 scopeid 0xa
>>>         inet 10.8.1.6 --> 10.8.1.5 netmask 0xffffffff
>>>         Opened by PID 347
>>>
>>>   Currently if I do a tcpdump on ng0, I can see the ICMP Echo replies
>>> going back out over ng0 while the requests come in over tun0.  I should
>>> also note that I haven't been able to get this working with ipfw fwd
>>> either.
>>>
>>>   options IPFIREWALL_FORWARD is in the kernel config as well.
>>>
>>>   Anyone have any idea what I'm missing?
>>
>> If the traffic is coming in on tun0 then you probably want reply-to not
>> route-to.
>
> Sorry, I should've mentioned that I've tried this too.  It's possible that
> I did it wrong, but I did variations of this:
>
> pass in quick on tun0 reply-to ( tun0 10.8.1.5 ) from any to
> 66.29.58.71/32 keep state
>
> If I'm doing this wrong, let me know.
>
> Regards,
> -JD-
>
>