rob, this one is actually pretty straightforward...
rdr (rewriting) takes place *before* ingress filtering. so you need to write your ipf "pass in" rules appropriately. read through these threads... http://marc.theaimsgroup.com/?l=ipfilter&m=101179250803382&w=2 http://marc.theaimsgroup.com/?l=ipfilter&m=99608074705794&w=2 http://marc.theaimsgroup.com/?l=ipfilter&m=99898624628175&w=2 http://marc.theaimsgroup.com/?l=ipfilter&m=99552181624892&w=2 http://marc.theaimsgroup.com/?l=ipfilter&m=101409568515510&w=2 and you'll clearly see why you need: pass in quick on dmfe0 proto tcp from any to 10.0.0.3/32 \ port = 3389 keep state jim Rob Nielsen wrote:
Hi, I'm using ipfilter 3.4.30, and am having problems trying to get rdr to work. Here's my configuration: ipf.conf pass in quick on dmfe0 proto tcp from any to a.b.c.d/32 port = 3389 keep state ipnat.conf rdr dmfe0 a.b.c.d/32 port A-> 10.0.0.3 port A tcp When I scan the port with nmap, the port shows up as filtered. Thanks, Rob
