PF Routing to VPN Device

Mike Sweetser - Adhost mikesw at
Wed Jun 17 19:46:48 UTC 2009


We have a network with a VPN device sitting beside a PF server, both
connected to an internal network.  

PF Server:
VPN Device:

The VPNs are set up for and, so any traffic to
these networks should be routed to  We've set up routes on
the PF server as such.

We've set up the following rules: 

block in log
pass in on $int_if route-to from to {

However, the block in log is catching the return traffic.  From pflog
when somebody on the VPN ( tries to connect to on
port 80:

000000 rule 28/0(match): block in on bge1: > [|tcp]

If we remove the block in log, the traffic works.

What are we missing?


More information about the freebsd-questions mailing list