specify output interface on filtered packet?

[Cross-posted to comp.unix.bsd.freebsd.misc,
comp.unix.bsd.openbsd.misc and comp.os.linux.networking.]

Hello,

Is it possible (using IPFilter/IPFW/IPTable/PF) to specify which
interface a packet should be sent out on?

_____
| |
Internal ----| R | fxp0 -----> HTTP/FTP/bulk ---|
|____| |
fxp1 \/
|--------> SSH/SMTP ---------> Internet

Depending on the filtering rules (in this case destination port), I
want to route packet(s) so they go out on a particular
interface. Each interface will have a different IP address (fxp0 will
actually be dynamic, and fxp1 static). There should not be routing
between fxp0 and fxp1.

All traffic from the internal network would also be NATed regardless
of the interface it goes out of.

I'm looking to do this on *BSD or Linux 2.4 (probably Debian). A
hardware router would be a third choice. (Linux may be the primary
choice because of internal support issues.)

Is doing what I want possible?

--
David Magda <dmagda at ee.ryerson.ca>, http://www.magda.ca/
Because the innovator has for enemies all those who have done well under
the old conditions, and lukewarm defenders in those who may do well
under the new. -- Niccolo Machiavelli, _The Prince_, Chapter VI

In article <(E-Mail Removed)> David Magda
<dmagda+(E-Mail Removed)> writes:
>
>[Cross-posted to comp.unix.bsd.freebsd.misc,
>comp.unix.bsd.openbsd.misc and comp.os.linux.networking.]
>
>Hello,
>
>Is it possible (using IPFilter/IPFW/IPTable/PF) to specify which
>interface a packet should be sent out on?
>
> _____
> | |
> Internal ----| R | fxp0 -----> HTTP/FTP/bulk ---|
> |____| |
> fxp1 \/
> |--------> SSH/SMTP ---------> Internet
>
>Depending on the filtering rules (in this case destination port), I
>want to route packet(s) so they go out on a particular
>interface. Each interface will have a different IP address (fxp0 will
>actually be dynamic, and fxp1 static). There should not be routing
>between fxp0 and fxp1.

AFAIK this is trivial with ipfilter, see the 'to' a.k.a. 'fastroute'
option.

>All traffic from the internal network would also be NATed regardless
>of the interface it goes out of.

I assume you mean that it should be NATed using the IP address of the
interface it goes out on. Doing that per se with ipnat (from ipfilter)
is no problem of course, but I'm not sure how the to/fastroute interacts
with NATing - it *could* be the case that the NATing gets bypassed.

--Per Hedeland
(E-Mail Removed)