binat-to address that's not assign to interface (4.9)

Brian Keefer <[email protected]> Tue, 25 Jan 2011 11:30:45 -0800
Newsgroups gmane.os.openbsd.pf
Message-ID <[email protected]>
I'm embarrassed to ask such a simple question.  Since 3.4 I've been running PF firewalls, but mostly for very small networks with 32 or fewer external addresses.  I always assigned my external IPs to my external interface and then did NAT or bi-NAT.

Now I'm building firewalls for much larger networks with /25 of external IPs.  They will all be either static or dynamic NAT, so proxy-ARP doesn't seem like the way to go.  Do I absolutely have to assign all these addresses to the external interface in order to use them for nat-to/binat-to, or can I simply have the upstream router set a route to one IP that I assign to the external interface (this is done already) and PF will be able to handle the translations?

--
bk