On Fri, 2004-09-10 at 16:02, Miles Keaton wrote:
> All the PF examples and even Jacek's book seem to assume you want to
> do NAT : the small-office setup : the one public IP and many
> 192.168.0.__ IPs inside.
>
> But how would PF be used as a router with many incoming IP addresses
> and many receiving IP addresses?
>
> Say I have incoming: from 123.45.67.80 to 123.45.67.89 on a T1 connection.
>
> One OpenBSD/PF machine is receiving that input on a single NIC card,
> and wants to send out some traffic on another NIC card connected to a
> switch like this:
>
> incoming 123.45.67.81 allow port 22,80,443 to go to internal 123.45.67.81
> incoming 123.45.67.82 allow port 22 to go to internal 123.45.67.82
> incoming 123.45.67.83 allow port 22,25,110 to go to internal 123.45.67.83
>
> Can PF do this kind of filter-and-route without doing NAT?
> If so, any URLs of examples? I can only find examples with NAT.
Yes, I have a filtering bridge with 10,000 machines on a /16 behind it.
7500 of these have entries on the firewall (in tables of course).
Just don't specify any NAT rules and you will be fine, everything works
as expected.
Check the syntax here, I'm at home and it's early in the morning...
block in on $ext_if any to any
block out on $ext_if any to any
pass in quick on $ext_if proto tcp from 123.45.67.81 to 123.45.67.81 port={22,80,443}
keep state
pass in quick on $ext_if proto tcp from 123.45.67.82 to 123.45.67.83 port= 22 keep
state
pass in quick on $ext_if proto tcp from 123.45.67.83 123.45.67.83 to port={22,25,110}
keep state
--
Russell Fulton, Information Security Officer, The University of Auckland
New Zealand
