# pf multiple binats and nat



## pacija (Feb 10, 2012)

Dear all,

*I* need to configure my firewall in a way that 4 servers are binatted (including traffic originating from them), and the outbound traffic from all other hosts (quit large network, 8 subnets) is natted.

Thought it would be easy like this:


```
match on $ext_if inet from $srv1_int to any binat-to $srv1_ext
match on $ext_if inet from $srv2_int to any binat-to $srv2_ext
match on $ext_if inet from $srv3_int to any binat-to $srv3_ext
match on $ext_if inet from $srv4_int to any binat-to $srv4_ext

match out on $ext_if inet from any to any received-on $int_if nat-to $nat_ext
```

Unfortunately, outbound traffic is always natted to $nat_ext, no matter where it originates from. Inbound traffic is binatted fine.

I thought it might be "last matching rule" which does the trouble so *I* put general nat above binats:


```
match out on $ext_if inet from any to any received-on $int_if nat-to $nat_ext

match on $ext_if inet from $srv1_int to any binat-to $srv1_ext
match on $ext_if inet from $srv2_int to any binat-to $srv2_ext
match on $ext_if inet from $srv3_int to any binat-to $srv3_ext
match on $ext_if inet from $srv4_int to any binat-to $srv4_ext
```

but it made no difference.

I know *I* could create a table like this (not exactly but *you* got the point):

```
table <generalnat> { subnet1 subnet2 subnetX !$srv1 !$srv2 etc }
```

and modify the rule to


```
match out on $ext_if inet from <generalnat> to any received-on $int_if nat-to $nat_ext
```

but *I* hope someone can point me to more elegant solution because in the future *I* expect to have even more subnets and binatted hosts, so maintaining such table would be major pain.

Thank you in advance,

PS: This is actually on OpenBSD 5.0 i386, but *I* guess that should make no difference.


----------

