- Code: Select all
`table <goodguys> {10.7.0.1, 10.7.0.2}`

nat on $ext_if from 10.7.0.1/24 to !10.7.0.1/24 -> $nat_ip

pass out from <goodguys> to any keep state

block log all

My question is, because NAT must be before filtering. If someone in network will set his ip address as 10.7.0.10, will it still be nated ? Is it a better way to do it ?

Like

- Code: Select all
`nat on $ext_if from <goodguys> to !10.7.0.1/24 -> $nat_ip`

But what will happen if <goodguys> is a table of, let's say 700 users ? (and correspondly bigger subnet , of course). Will it have a big impact on performance ?