I don't understand your concerns - can you explain why the IP address you use matters (beyond what the instructor wants)?
Honestly, and I might have said this before now, but I don't think that in a real-world scenario that this would matter at all. Internet routers aren't supposed to even route traffic for RFC 1918 addresses in the first place. The only instance where it would matter AFAIK, is if a "boss" gave specific instructions that said access was to be prohibited. But then again, those kind of circumstances would likely be rare.
The main reason that PF didn't work in my case is because of the nature of the assignment. The actual assignment wasn't really about NAT or even firewalls at all - the class is about VPNs. Where NAT became an issue, and where the firewall came into play, is because we had to setup a "fake" Internet using the PF boxes, with two Web servers (one a public server, the other a private intranet server). So, the whole point really was that the access had to be very limited unless the traffic was coming in through one of the VPN tunnels. This was why I would have failed had the instructor had direct access to the private network. The main root of my problem was that the fake "Internet" host was directly connected to the WAN interface on the PF box hosting the Web server, so, PF kept routing the traffic, and there wasn't anything I could do with the rules to make it stop. (Without breaking NAT.) Like you said, NAT itself is not a security mechanism, but being unable to Firewall that traffic made it a security hole in this context.
Beyond the assignment, the only real-world scenario I could think of is if a company had multiple LAN subnets connected via a PF box, with certain subnets using NAT for whatever reason, and a requirement being that one LAN cannot directly access the other LAN.
Indeed, they'll have to work out that LAN IP to be able to reach it directly - if you've selected something random, not just 192.168.0.x then it'll take a brute force search of all 3 RFC 1918 ranges to find it.
Unless this was a company that fired their network administrator and you had a disgruntled ex-employee with intricate knowledge of the private network. I would hope most people would not drop to this level, but in Information Security, they cover all possible aspects. When my school competed in the Computer Cyber Defense Competition this year, we had to defend our network from an entire team (about 30 - 40 people) who were trained expert penetration testers. Some of the things I saw at that competition are still a whirlwind in my brain. Let's just put it this way, out of 8 teams competing at the Regional Competition, zero of them had functioning networks on Day 3 of the 3-day competition.
Getting back on topic, I don't have the super-expertise of how to break into networks … to the average random script kiddie or the like, there would likely be no issue here. But, being a security class, I was forced to cover as many bases as possible, defense in depth and layers, so to speak.
People such as your instructor need to remember that NAT is not a security feature, and it's going away with IPv6 anyway.
Amen to that!
Anyway, I got an 'A' on the assignment, so I'm happy. I was just mentioning the issue I had here because I couldn't find anything anywhere when I was pulling my hair out trying to figure out why I could access the private IP of the Web server with my VPN tunnels down.
You might give the "pass" associated firewall rule type on 2.0 a try, I wonder if it works the same way because it doesn't use a separate firewall rule, just "rdr pass …".
I've used PF 2.0 a couple times, and I really like where the project is headed. 2.0 made it so much easier to adjust the max number of simultaneous PPTP users right from the WebGUI. I'll fire up the 2.0 VM sometime and try this NAT thing out on that and see how it goes.
