Colin Harford said:
> no rdr on { lo0 } from any to any
>
>
> It comes right from the sample pf.conf.... any traffic on local
> interfaces are never rdr'd.
>
> I have tried without that line, and the problem still remains.
I don't know where you found your sample pf.conf (don't tell me - I don't
care), but FWIW here's the pf.conf I'm using on my 3.3 system. I had a point
of confusion re the need for the "pass" statement in addition to the "rdr";
some of the folks here on this list squared me away on why that's needed.
You may want to refer to that thread in the archives: Oct 12 & 13, 2003.
Anyway - I didn't see a pass statement in your pf.conf snippet, so this may
be your problem, too. If that doesn't get it going let us know.
Jay
=============== begin pf.conf ===============
# These rules for a mail server
ExtIF="rl0"
LoopBk="lo0"
AllowTcpIn="{ 22, 25, 113 }"
AllowUdpIn="{ }"
AllowIcmpIn="echoreq"
NoRouteIPs="{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
table <spamd> persist
# options
set block-policy return
set loginterface $ExtIF
# scrub
scrub in all
# redirection rule for spamd; send scum to tarpit :)
# make sure spamd is started in rc & setup w/ spamd-setup
rdr inet proto tcp from <spamd> to any port smtp -> 127.0.0.1 port 8025
# filter rules - default deny everything
block all
# Allow loopback packets
pass quick on $LoopBk all
# Allow the spamd connections -->> ?? WHY ?? <<--
pass in on $ExtIF inet proto tcp from <spamd> to 127.0.0.1 port 8025 \
flags S/SA keep state
# block RFC 1918 addresses from entering or exiting ext_if
# "block drop" -> don't respond w/ TCP RST or ICMP Unreachable packet
# block drop in quick on $ExtIF from $NoRouteIPs to any
# block drop out quick on $ExtIF from any to $NoRouteIPs
# open ports we want accessible from Internet
pass in on $ExtIF inet proto tcp from any to $ExtIF port $AllowTcpIn \
flags S/SA keep state
# pass required ICMP traffic
pass in inet proto icmp all icmp-type $AllowIcmpIn keep state
# pass traffic out on the interface
pass out on $ExtIF proto tcp all modulate state flags S/SA
pass out on $ExtIF proto { udp, icmp } all keep state
================ end pf.conf ================
