Pfsense 2.0 Order of NAT and Firewall rules – very confusing
-
Hi. First post.
This is probably a noob question and I'm sure many people here can answer it in their sleep, but I'm clearly missing something very basic. After doing a lot of searching on the forum, it seems clear to me that pfsense processes NAT rules on a given interface before firewall filters…
(http://forum.pfsense.org/index.php/topic,11039.msg61301.html#msg61301)
(http://forum.pfsense.org/index.php/topic,1903.msg10976/topicseen.html#msg10976)I have two gateways on my setup, WAN and OPT1. I've set OPT1 as the default gateway for all traffic, and have appropriate NAT on those two interfaces. There is a single client on my LAN that I want to force through the WAN gateway instead, so I setup a firewall rule on the LAN interface passing traffic from 192.168.1.client to the WAN gateway. Everything works as desired.
My question is if NAT is applied before firewall rules, how is this firewall rule even working? How does pfsense know that these packets actually came from my LAN client if they've already been NAT'd to the LAN interface IP? I appreciate any help because I clearly am misunderstanding something fundamental about pfsense NAT/firewalling. Thanks.