summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorsthen <sthen@openbsd.org>2009-11-05 16:01:36 +0000
committersthen <sthen@openbsd.org>2009-11-05 16:01:36 +0000
commitd4b350f295449acb3b399e4a9dd5d4a20d932f64 (patch)
treeacbfcdf9087c6cf8045175f01f31bab56d54f373
parentfortunes fix from dougb@freebsd, revision 198921 (diff)
downloadwireguard-openbsd-d4b350f295449acb3b399e4a9dd5d4a20d932f64.tar.xz
wireguard-openbsd-d4b350f295449acb3b399e4a9dd5d4a20d932f64.zip
Adjust the description of network translation to match the code
following the nat-to changes. Reworked slightly from a diff from eric@. ok henning jmc
-rw-r--r--share/man/man5/pf.conf.530
1 files changed, 9 insertions, 21 deletions
diff --git a/share/man/man5/pf.conf.5 b/share/man/man5/pf.conf.5
index 7927bd62d3d..6ebbb8a61bd 100644
--- a/share/man/man5/pf.conf.5
+++ b/share/man/man5/pf.conf.5
@@ -1,4 +1,4 @@
-.\" $OpenBSD: pf.conf.5,v 1.461 2009/10/14 14:17:53 jmeltzer Exp $
+.\" $OpenBSD: pf.conf.5,v 1.462 2009/11/05 16:01:36 sthen Exp $
.\"
.\" Copyright (c) 2002, Daniel Hartmeier
.\" All rights reserved.
@@ -27,7 +27,7 @@
.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: October 14 2009 $
+.Dd $Mdocdate: November 5 2009 $
.Dt PF.CONF 5
.Os
.Sh NAME
@@ -735,28 +735,16 @@ pass out proto { tcp, udp } all user { \*(Lt 1000, dhartmei }
.Ed
.El
.Ss Translation
-Translation options modify either the source or destination address of the
-packets associated with a stateful connection.
-A stateful connection is automatically created to track packets matching
-such a rule as long as they are not blocked by the filtering section of
-.Nm .
-The translation engine modifies the specified address and/or port in the
-packet, recalculates IP, TCP, and UDP checksums as necessary, and passes it to
-the packet filter for evaluation.
+Translation options modify either the source or destination address and
+port of the packets associated with a stateful connection.
+.Xr pf 4
+modifies the specified address and/or port in the packet and recalculates
+IP, TCP, and UDP checksums as necessary.
.Pp
-Since translation occurs before filtering,
-the filter engine will see packets as they look
+Subsequent rules will see packets as they look
after any addresses and ports have been translated.
-Filter rules will therefore have to filter based on the translated
+These rules will therefore have to filter based on the translated
address and port number.
-Packets that match a translation rule are only automatically passed if the
-.Ar pass
-modifier is given,
-otherwise they are still subject to
-.Ar block
-and
-.Ar pass
-rules.
.Pp
The state entry created permits
.Xr pf 4