confusion with the pf filter rule syntax

From: Sameer (ssnewsgroups_at_hotmail.com)
Date: 11/24/03


Date: Mon, 24 Nov 2003 06:24:05 GMT

this is what the FAQ says:

action direction [log] [quick] on int [af] [proto protocol] from src_addr
[port src_port] to dst_addr [port dst_port] [tcp_flags] [state]

i'm a bit confused here. personally, i'm having issue with this "on int"
and "from src_addr". to me this seems to be a redundancy, and, not matter
how i tried to read it, i really can't see otherwise.

why do you need to state an interface as well as a source address? won't it
suffice to simply state a source and a destination, thereby circumventing
the "on int" portion?

for example, say you are looking to allow packets outside a device with the
following parameters:

outside interface, hme0 - 172.16.0.1
inside interface, hme1 - 192.168.1.1

can't you say,

pass out from 192.168.1.1 proto tcp to any modulate state

or

pass out on hme1 proto tcp to 182.16.0.1 modulate state

maybe i'm not understanding something that someone might see... so any
explanation would be helpful.

i know some will say "go away and don't bother us until you test it
yourself" ... however, i really would like to understand the syntax properly
instead of being hit and miss with trial and error. the understanding is
more important to me than getting it to work.