Really need an option to force firewall rules before NAT - I need to keep scumbags and scammers out but OpnSense lets them through - as I have found here NAT is applied before Firewall rules - I want an option not to - if I block a country I expect it blocked even from NAT traversal or I need to put a firewall on every internal box - this isn't efficient.
If I have missed something and there is a setting could somebody expose it please.
I mean you can use a GeoIP alias in your NAT rules as well, then it won't even be translated.
In a NAT rule in advanced mode its "Do not NAT".
BTW:
NAT is not allowing traffic, its only translation
Firewall rules are allowing traffic