Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT and filtering order of operations

    Scheduled Pinned Locked Moved NAT
    2 Posts 2 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Alx1m1K
      last edited by

      Hello. Maybe a dumb question, but why in pfsense there is NAT translation first and only after that packet filtering takes place?
      Are there some restrictions in pf? Because as I believe more natural and secure way to do this is perform filtering first and after that translating allowed packets (as it is in most vendors devices).
      Or maybe there is a way to change this behavior?
      Thanks in advance!

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        That's the way that pf (the packet filtering software used by pfSense) works, and doing it this way has its own set of advantages as well. There's no way to change it that I'm aware of, I'm sure if you dig around the OpenBSD/pf docs you can find the reason why they decided on doing it that way.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.