Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wondering when a packet reaches an interface and I have some PF rules, which gets checked first, the routing table or the ruleset?

ext_if = "em0"  
int_if = "em1" 
localnet = $int_if:network
VPN_if =

nat log on $ext_if from any to any -> ($ext_if)
rdr pass log on $ext_if proto tcp from !($ext_if) to any port 1:65000\
        -> $VPN_if port 2500
pass log from { lo0, $localnet } to any keep state
share|improve this question
up vote 4 down vote accepted

In FreeBSD the firewalls (IPF, IPFW, and PF) sit between the Device Driver and the IP Stack.
Routing is part of the IP Stack.

share|improve this answer
so if i have a redirect rule in my PF ruleset that doesnt comply with the routing table, the PF rules wins? – nawar Jan 2 '14 at 12:54
PF Redirect just changes the destination IP of a packet, it doesn't route the packet. – Chris S Jan 2 '14 at 13:56
Thanks. So I have a BSD machine that runs NATing using PF. After de-nating, I want to force some packets to be routed to a machine in the LAN behind the NAT machine while not messing with the packet. Can PF help in achieving that? – nawar Jan 2 '14 at 14:33
I'm not following... Perhaps explain the situation surrounding this? – Chris S Jan 2 '14 at 15:21
I am developing a VPN app running on a BSD server (lets call it V) and mobile clients (M). The clients send packets with private IPs. I also have a NATing server using PF (N). M sends requests to V, which forwards the traffic to N, which then NATs and send the traffic to the internet. When N reverses the NATing, the packet's destination is private and doesn't belong to this LAN. I want to redirect this traffic using PF to V again to send the traffic to M through the established tunnel. Can redirection rules work here? I hope this clarifies the situation. Thanks! – nawar Jan 2 '14 at 15:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.