On Sat, Jul 25, 2020 at 09:37:37PM +0900, YASUOKA Masahiko wrote: > Is this part a reason why we have "divert-reply"?
Yes. Divert rules pass packets to the local network stack. With divert-to you specify the socket address. This works for incomming connections. The divert-to address can be 127.0.0.1 or anything else with SO_BINDANY. When you use SO_BINDANY for outgoing connections and you don't know the addresses when writing pf.conf, use divert-reply. As dangling states interfere with new connections, I added the divert state cleanup. This is especially necessary for DGRAM or RAW sockets. > > Is that not possible for you? > > It's possible. Fine, then use divert-reply instead of changing the semantics. bluhm
