PF nat + pass rules

[xpenziuz]

hi. i have a network like this:

            |   |--VLAN100 (192.168.3.1)| LOCAL-VLAN
ISP--PUB-IP--   |
            |   |--VLAN200 (192.168.2.1)| LOCAL-VLAN

I use these rules,

ext_if = "re1"
vlan100 = "vlan100"
vlan200 = "vlan200"

nat on $ext_if from $vlan100 to any -> ($ext_if)
nat on $ext_if from $vlan200 to any -> ($ext_if)

pass on $vlan100 from $vlan100:network to any
pass on $vlan200 from $vlan200:network to any

The problem is really that when i use the rules above i can go from vlan100 to vlan200 via nat, i want to have rules like

pass on $vlan100 from $vlan100:network to any [B]out via $ext_if

so that traffic only is possible between $ext_if and vlan100 not between vlan100 and vlan200, is there nice way to do this ?

Thanks for all reply's
Alex

 

[SirDice]

How about something like this?

pass on $vlan100 from $vlan100:network to !$vlan200:network
pass on $vlan200 from $vlan200:network to !$vlan100:network

 

[xpenziuz]

Thanks, it worked