Do packets routed to another interface using `pf`'s `route-to` option on macOS actually pass the given interface? Do packets routed to another interface using pf's route-to option on macOS actually pass the given interface?


I've read that pf's firewall rules only applies to packets that (physically) pass the given interface. Thus, rules for a gateway's external interface will not apply to packets entering on the local interface and destined for the external interface, since the TCP/IP stack handles such packets internally.

Thus, do packets that are route-to (filter rule) another interface on the gateway pass that interface, so that the interface's rules will apply to the packet?

Here is the documentation from the OSX man page:

 route-to
       The route-to option routes the packet to the specified interface with an optional address for the next hop.  When a route-to rule creates state, only packets that pass in the same direction as the filter
       rule specifies will be routed in this way.  Packets passing in the opposite direction (replies) are not affected and are routed normally.
I've read that pf's firewall rules only applies to packets that (physically) pass the given interface.


I remember answering to your similar question on unix.stackexchange.com


  Thus, rules for a gateway's external interface will not apply to packets entering on the local interface and destined for the external interface, since the TCP/IP stack handles such packets internally.


Pf's rules do apply to traffic over loopback too unless you're specifically exclude it with smth like set skip on lo0.

You also better keep in mind that Pf's version shipped with MacOS is severely outdated and some documented features of Pf don't work at all or work incorrectly. route-to is somewhat "hacky" feature and I won't be any surprised if it'd fail in similar ways.