NAT and filtering order of operations
-
Hello. Maybe a dumb question, but why in pfsense there is NAT translation first and only after that packet filtering takes place?
Are there some restrictions in pf? Because as I believe more natural and secure way to do this is perform filtering first and after that translating allowed packets (as it is in most vendors devices).
Or maybe there is a way to change this behavior?
Thanks in advance! -
That's the way that pf (the packet filtering software used by pfSense) works, and doing it this way has its own set of advantages as well. There's no way to change it that I'm aware of, I'm sure if you dig around the OpenBSD/pf docs you can find the reason why they decided on doing it that way.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.