> Forget for a second what you *want* to have happen, and look at the 
> above snippets of your pf.conf. What's the *last* matching rule for 
> something on $ExtIfa?

For nat/rdr rules, it's the *first* match.

Reply via email to