upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-03-01 21:01:24 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

pf.conf.5: revise divert-to and divert-reply

Browse source 
(cherry picked from commit 7e1affa242ca83710eb64e2c6184263fbea3deb7)
This commit is contained in:
Igor Ostapenko 2023-11-17 22:01:17 +02:00 committed by Kristof Provost
parent 16a379ffde
commit acfc2a0500
1 changed files with 15 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
share/man/man5/pf.conf.5
View file

@ -27,7 +27,7 @@
.\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd October 27, 2023
.Dd November 17, 2023
.Dt PF.CONF 5
.Os
.Sh NAME
@ -2102,19 +2102,22 @@ Only effective before the route lookup happened, i.e. when filtering inbound.
.It Xo Ar divert-to Aq Ar host
.Ar port Aq Ar port
.Xc
Used to redirect packets to a local socket bound to
.Ar host
and
Used to
.Xr divert 4
packets to the given divert
.Ar port .
The packets will not be modified, so
.Xr getsockname 2
on the socket will return the original destination address of the packet.
Historically
.Ox pf has another meaning for this, and
.Fx pf uses
this syntax to support
.Xr divert 4 instead. Hence,
.Ar host
has no meaning and can be set to anything like 127.0.0.1.
If a packet is re-injected and does not change direction then it will not be
re-diverted.
.It Ar divert-reply
Used to receive replies for sockets that are bound to addresses
which are not local to the machine.
See
.Xr setsockopt 2
for information on how to bind these sockets.
It has no meaning in
.Fx pf .
.It Ar probability Aq Ar number
A probability attribute can be attached to a rule, with a value set between
0 and 1, bounds not included.