Need an option - if it isn't there ...

[BenKenobi]

Really need an option to force firewall rules before NAT - I need to keep scumbags and scammers out but OpnSense lets them through - as I have found here NAT is applied before Firewall rules - I want an option not to - if I block a country I expect it blocked even from NAT traversal or I need to put a firewall on every internal box - this isn't efficient.

If I have missed something and there is a setting could somebody expose it please.

[Monviech (Cedrik)]

I mean you can use a GeoIP alias in your NAT rules as well, then it won't even be translated.

In a NAT rule in advanced mode its "Do not NAT".

BTW:

NAT is not allowing traffic, its only translation
Firewall rules are allowing traffic

[Patrick M. Hausen]

Don't use destination NAT with "pass", then.

[BenKenobi]

Well despite the responses - I mean NAT without a 'pass' is pretty pointless -

I take issue with "Firewall rules are allowing traffic" no they aren't - the NAT bypasses firewall rules completely.

I found the solution here, it is still wrong IMHO that firewall rules are not enforced before NAT - should only be presented for NAT if it does not violate any block list which is exactly what the thread linked below does.

https://forum.opnsense.org/index.php?topic=46122.0