Re: policy route for locally originating traffic

Hi Rolf,

I've not done this myself with OpenBSD but I have on Linux. OpenBSD
can accomplish this as well but not with just pf alone.

I believe what you should look into is "routing domains". A google
search "openbsd routing domains" should provide you with what you are
looking for.

Hope that helps,
Wayne

On Mon, Dec 14, 2015 at 12:27:27PM +1100, Rolf wrote:
> Hello=20
>=20
> I=E2=80=99m new to pf and am using it on OS X 10.11
>=20
> When I have my OS X host connected to two networks, say Wifi and a wire=
d ethernet I=E2=80=99d like to arrange for specific services to specific =
destinations be directed to the wifi network, while the ethernet carries =
other traffic.
>=20
> No matter what combination I try with pfctl I cannot make it work.
>=20
> In the documentation there is the - correct - implication that all rout=
ing is that defined as traffic arriving on one interface and leaving on a=
nother, which is not the case when I am using a single OS X host.  So I=E2=
=80=99m tempted to think this rather perverted use of routing is simply n=
ot possible with pf.=20
>=20
> I=E2=80=99ve tried many combinations but typically they are variations =
on this:
>=20
> pfctl pass route-to ($device $gateway) from any to $destinationNetwork =
$service
>=20
> I=E2=80=99ve tried explicitly stating interfaces and their direction (i=
n, out) as well as stating tcp protocol as well.  I=E2=80=99ve simplified=
 further leaving out the service involved, I=E2=80=99ve also tried using =
the reply-to command but I don=E2=80=99t believe i need that.
>=20
> I know the config has an effect usually by my tests breaking all connec=
tivity...
>=20
> So I=E2=80=99d be very appreciative if I can be shown a way to setup th=
e above config.  So I can get access to particular services via one inter=
face while everything else goes via the other.  Or to say its not possibl=
e.
>=20
> Thanks very much,
>=20
> r.