Other IN and OUT on same I/F?

[byrnejb]

Do any of the FreeBSD wirewall permit packets to enter and exit on the same I/F? I discovered that PF does not permit this. DO either IPFW or IPFILTER permit this?

This feature is supported by IPTABLES on CentOS and we need this capability for historic reasons which cannot easily be altered.

 

[mer]

I think that PF by default uses the routing tables to pick egress interfaces, but seem to recall a "redirect" that could push to an interface.

 

[PMc]

IPFW does filter the packets when they come in through some interface, and does filter them again when they go out through some interface (given that one_pass is disabled). It does not care about which interface that is, so if you get your routing to do such a thing, that is of no concern to IPFW.

 

[SirDice]

I think that PF by default uses the routing tables to pick egress interfaces, but seem to recall a "redirect" that could push to an interface.

Yes, but you cannot "bounce" packets out the same interface they came in on.

     Redirections cannot reflect packets back through the interface they
     arrive on, they can only be redirected to hosts connected to different
     interfaces or to the firewall itself.

 

[Eric A. Borisch]

You can use something like xinetd(8) and its redirect service type to bounce a tcp stream elsewhere.