Need an option - if it isn't there ...

[BenKenobi]

Really need an option to force firewall rules before NAT - I need to keep scumbags and scammers out but OpnSense lets them through - as I have found here NAT is applied before Firewall rules - I want an option not to - if I block a country I expect it blocked even from NAT traversal or I need to put a firewall on every internal box - this isn't efficient.

If I have missed something and there is a setting could somebody expose it please.

[Monviech (Cedrik)]

I mean you can use a GeoIP alias in your NAT rules as well, then it won't even be translated.

In a NAT rule in advanced mode its "Do not NAT".

BTW:

NAT is not allowing traffic, its only translation
Firewall rules are allowing traffic

[Patrick M. Hausen]

Don't use destination NAT with "pass", then.