On Thu, 29 Jul 2004 lola at yais dot net wrote:

> > Question 2: Do the filter rules get processed before that NAT rules?
> > Like if I create a rule that says "Drop all traffic from 192.168.1.50",
> > will it still get NAT'd out to the WAN?
>
> nat happens before looking at the rules. this means your ruleset only "sees"
> the already natted ips.

actually, for outgoing packets, ipfilter sees them before ipnat, hence in
the OP's question, that rule would drop all packets from 192.168.1.150 and
not allow them out the WAN.

Regards,                           /\_/\   "All dogs go to heaven."
dinesh at alphaque dot com                (0 0)    http://www.alphaque.com/
+==========================----oOO--(_)--OOo----==========================+
| for a in past present future; do                                        |
|   for b in clients employers associates relatives neighbours pets; do   |
|   echo "The opinions here in no way reflect the opinions of my $a $b."  |
| done; done                                                              |
+=========================================================================+