PF pass rule can't see return nat packets

[freedubio]

Hi I am trying to share the vpn with the whole lan:

lan ------- ------------
-------------------------------------| FW |----------------| Internet |
| en0 | ^ ------- ------------
------ ------- |
| A | | B | | lan default route
------- ------
| abc0
|
| VPN
|


My NAT rule works fine:
nat on abc0 from en0:network to any -> (abc0)

But this rule does not log:
pass in log on abc0

(those are the only rules)
Nothing gets logged coming in that interface unless it was not NATed.

My goal is actually this:
pass in log on abc0 route-to (en0 10.10.10.1) from !en0:network flags any

because I want to force packets coming back from the VPN to bounce off the default route on the local lan, since I am not going to copy all the vpn routes to every box on the lan, just the FW box, and the routes need to be symmetric.

Why can't pf see the packets coming back from the vpn if they were NATed?

Thanks.

 

[freedubio]

haha my lan pic got all messed up. try this instead

 

[`Orum]

My NAT rule works fine:
nat on abc0 from en0:network to any -> (abc0)

But this rule does not log:
pass in log on abc0
...
Why can't pf see the packets coming back from the vpn if they were NATed?
Thanks.

Look carefully at what your rules say. Specifically:
pass [B]in[/B] log on abc0
For hosts on your LAN, they get NATed but they never go in on abc0, only out. Once the state is created the returning traffic hits the state table and thus isn't logged. If you want to log only traffic that gets NATed from hosts on your en0:network (and only that source network), you'll actually need two rules; one to tag traffic as coming from that network (or the en0 interface), and another to actually apply the log command for outgoing traffic on abc0 that was tagged by the inbound rule.

 

[Lamia]

My NAT rule works fine:
nat on abc0 from en0:network to any -> (abc0)

But this rule does not log:
pass in log on abc0

First, there is no pass out log on........
Second, if you want all your lan connections going through a vpn, you could simply deploy the openvpn (I suppose) on every system/PC. All PCs wanting to use the VPN must connect to the VPN server as VPN clients.

I am not sure a dnsmasq via a second NIC on one of the PCs associated with the VPN (acting as a gateway for the lan) is worth exploring.