Using the to Keyword to Capture Blocked Packets

You can use the to keyword apart from the from keyword. If you want to block a packet, you can use the to keyword to push the packet past the normal routing table and force it to go out on a different interface. For example:

block in quick on lan0 to lan1 proto tcp from any to any port <  1024

This rule blocks incoming packets, but also forces them over to the lan1 interface, where they can be logged. If you log blocked packets this way, you can then analyze blocked traffic for possible attacks on the system.

Use block quick for to interface routing because the to interface code will generate two packet paths through IPFilter when used with pass.

	NOTE: If you are configuring rules to pass packets, but also want the packets to go to another interface, use the dup-to keyword. See “dup-to: Drop-Safe Logging”.