TL;DR - I'd like to set up a FreeBSD VM with one network card on my home LAN (192.168.1.0/24) and one on a private-internal-to-virtualbox network (10.9.9.0/24) and pass any and all traffic back and forth between the two.Long time Linux user (Debian on servers) but only been using FreeBSD for about a day :)Anyway, for my experimental stuff I have a virtualbox machine with 2 network interfaces - one bridged to my home LAN, one on an internal-only network.  This machine is set up to be a block-nothing router, simply passing packets between eth0 and eth1 no matter source or destination.  Easy enough to do with iptables - iptables -A FORWARD -i eth0 -o eth1 -j ACCEPTiptables -A FORWARD -i eth1 -o eth0 -j ACCEPTBut I've been trying to get this to work with pf and I'm only having partial success.With gateway_enable=YESpf_enable=YESpf_rules=/etc/pf.confin my /etc/rc.conf and /etc/pf.conf containingpass from em1:network to any keep statepass from em0:network to any keep statepass in inet proto tcp to any keep statepass in inet proto udp to any keep statepass out inet proto tcp to any keep statepass out inet proto udp to any keep stateI can start a live disc vm attached only to internal and set the em1's IP as the default gateway, and be able to ping em1, ping em0, but I can't ping the host machine vbox is running on or any other machine on my LAN or connect via http, ssh, etc.[root@bsdtest ~]# pfctl -saFILTER RULES:pass in inet proto tcp all flags S/SA keep statepass in inet proto udp all keep statepass out inet proto tcp all flags S/SA keep statepass out inet proto udp all keep statepass inet from 10.9.9.0/24 to any flags S/SA keep statepass inet from 192.168.1.0/24 to any flags S/SA keep stateSTATES:all tcp 192.168.1.90:22 <- 192.168.1.10:48102       ESTABLISHED:ESTABLISHEDall udp 192.168.1.2:53 <- 10.9.9.5:59075       NO_TRAFFIC:SINGLEall udp 10.9.9.5:59075 -> 192.168.1.2:53       SINGLE:NO_TRAFFICall udp 192.168.1.2:53 <- 10.9.9.5:34207       NO_TRAFFIC:SINGLEall udp 10.9.9.5:34207 -> 192.168.1.2:53       SINGLE:NO_TRAFFICall udp 192.168.1.2:53 <- 10.9.9.5:43515       NO_TRAFFIC:SINGLEall udp 10.9.9.5:43515 -> 192.168.1.2:53       SINGLE:NO_TRAFFICall udp 192.168.1.2:53 <- 10.9.9.5:1636       NO_TRAFFIC:SINGLEall udp 10.9.9.5:1636 -> 192.168.1.2:53       SINGLE:NO_TRAFFICall udp 192.168.1.2:53 <- 10.9.9.5:60124       NO_TRAFFIC:SINGLEall udp 10.9.9.5:60124 -> 192.168.1.2:53       SINGLE:NO_TRAFFICall udp 192.168.1.2:53 <- 10.9.9.5:8866       NO_TRAFFIC:SINGLEall udp 10.9.9.5:8866 -> 192.168.1.2:53       SINGLE:NO_TRAFFICall udp 192.168.1.2:53 <- 10.9.9.5:25534       NO_TRAFFIC:SINGLEall udp 10.9.9.5:25534 -> 192.168.1.2:53       SINGLE:NO_TRAFFICall udp 192.168.1.2:53 <- 10.9.9.5:30141       NO_TRAFFIC:SINGLEall udp 10.9.9.5:30141 -> 192.168.1.2:53       SINGLE:NO_TRAFFICINFO:Status: Enabled for 0 days 00:08:28           Debug: UrgentState Table                          Total             Rate  current entries                       17                 searches                            1990            3.9/s  inserts                              253            0.5/s  removals                             236            0.5/sCounters  match                                253            0.5/s  bad-offset                             0            0.0/s  fragment                               0            0.0/s  short                                  0            0.0/s  normalize                              0            0.0/s  memory                                 0            0.0/s  bad-timestamp                          0            0.0/s  congestion                             0            0.0/s  ip-option                              0            0.0/s  proto-cksum                            0            0.0/s  state-mismatch                         0            0.0/s  state-insert                           0            0.0/s  state-limit                            0            0.0/s  src-limit                              0            0.0/s  synproxy                               0            0.0/s  map-failed                             0            0.0/sTIMEOUTS:tcp.first                   120stcp.opening                  30stcp.established           86400stcp.closing                 900stcp.finwait                  45stcp.closed                   90stcp.tsdiff                   30sudp.first                    60sudp.single                   30sudp.multiple                 60sicmp.first                   20sicmp.error                   10sother.first                  60sother.single                 30sother.multiple               60sfrag                         30sinterval                     10sadaptive.start             6000 statesadaptive.end              12000 statessrc.track                     0sLIMITS:states        hard limit    10000src-nodes     hard limit    10000frags         hard limit     5000table-entries hard limit   200000OS FINGERPRINTS:758 fingerprints loaded[root@bsdtest ~]# Any ideas?  The lines regarding udp traffic to 192.168.1.2 from 10.9.9.5 (my live disc) would be for DNS to my home LAN name server, but no responses ever arrive... Here's what a http request shows -[root@bsdtest ~]# pfctl -sa | grep 80all tcp 192.168.1.10:80 <- 10.9.9.5:59436       CLOSED:SYN_SENTall tcp 10.9.9.5:59436 -> 192.168.1.10:80       SYN_SENT:CLOSEDall tcp 192.168.1.10:80 <- 10.9.9.5:59438       CLOSED:SYN_SENTall tcp 10.9.9.5:59438 -> 192.168.1.10:80       SYN_SENT:CLOSEDIdeas?
Totally open FreeBSD router in VirtualBox
freebsd;routing;firewall;pf