Re: Need help with reflection (nat and rdr) on the same interface

2011-04-09 Thread Stuart Henderson
sysctl net.inet.ip.forwarding=1 On 2011-04-08, rancor theran...@gmail.com wrote: Thanks of your reply. It does still not work. I can't see any data leaving the mirror to the server. Nothing is blocked in pflog0 and tcpdump does not show any connections to 74.125.43.99 This is my pf.conf

Re: Need help with reflection (nat and rdr) on the same interface

2011-04-08 Thread Stuart Henderson
On 2011-04-07, rancor theran...@gmail.com wrote: I want to reflect all IP from a client to a server via another machine called mirror. client and server can't access each other and there is nothing I can do about that. How ever the mirror can access both client and server so I want all traffic

Re: Need help with reflection (nat and rdr) on the same interface

2011-04-08 Thread rancor
Thank you How ever, you example was not valid /etc/pf.conf:x: nat-to can only be used outbound /etc/pf.conf:x: skipping rule due to errors /etc/pf.conf:x: rule expands to no valid combination The nat-to must be out but it did not work anyway. ext_if= { vic0 } client= {

Re: Need help with reflection (nat and rdr) on the same interface

2011-04-08 Thread Peter N. M. Hansteen
rancor theran...@gmail.com writes: How ever, you example was not valid That's odd. But then again the devil is in the details, it's easy to trip up on something if you don't understand the mechanics of nat and redirection. Try and compare with the examples in The Book of PF 2nd ed and the the

Re: Need help with reflection (nat and rdr) on the same interface

2011-04-08 Thread rancor
Thanks of your reply. It does still not work. I can't see any data leaving the mirror to the server. Nothing is blocked in pflog0 and tcpdump does not show any connections to 74.125.43.99 This is my pf.conf [snipp] # Macro admin= { xxx xxx } ext_if= { vic0 } client=

Re: Need help with reflection (nat and rdr) on the same interface

2011-04-07 Thread Gregory Edigarov
seems like you want a dup-to rule On Thu, 7 Apr 2011 10:36:16 +0200 rancor theran...@gmail.com wrote: Hi. I need help with a problem of mine. I want to reflect all IP from a client to a server via another machine called mirror. client and server can't access each other and there is

Re: Need help with reflection (nat and rdr) on the same interface

2011-04-07 Thread rancor
Thanks. But I don't think functionality has change, just syntax. I got it working with the example below and I need help to get the syntax right to match pf.conf since the changes of 4.7 Regards 2011/4/7 Gregory Edigarov g...@bestnet.kharkov.ua: seems like you want a dup-to rule On Thu, 7