Re: Redirection - feeling utterly stupid

[Johan Helsingius]

Karl,

 The rule in pf is that the last pass/block match wins, unless you
 say otherwise with quick. 

Indeed. It's something that is too easy to forget when you try things.
I had it right before, but got the order of the lines wrong as part
of trying to get it to work. Thanks for the correction.

I feel less stupid now, as it turns out I had gotten it right
after all (in an earlier version of the config), the problem
seems to lie with either my ADSL modem or my ISP dropping
packets to port 80 - connections to port 8080 (or anything
except 80) works OK. Sounds like a broken web cache...

Julf

Re: Redirection - feeling utterly stupid

[Karl O. Pinc]

On 12/29/2010 03:06:27 PM, Johan Helsingius wrote:
 I am starting to despair at ever understanding pf redirection/NAT.
 
 I have been trying to build a very simple redirection where
 a openbsd firewall running pf sits between the ADSL modem
 and a controller.
 
 I have now simplified the pf config to this:
  
 
 ext_if = ¨rl0¨
 int_if = ¨xl2¨
 
 controller = ¨172.24.44.89¨
 
 set skip on lo
 
 block log all
 
 pass in log on $int_if
 pass out log on $int_if
 
 pass log on $ext_if from $controller to any binat-to $ext_if:0
 pass log on $ext_if
 
  
 
 but it still seems like there is no natting, as packets from the
 controller seem to go out with the internal, non-routable address,
 so no packets ever get back.

The rule in pf is that the last pass/block match wins, unless you
say otherwise with quick.  So, your last two lines should be
either:

pass quick log on $ext_if from $controller to any binat-to $ext_if:0
pass log on $ext_if

or:

pass log on $ext_if
pass log on $ext_if from $controller to any binat-to $ext_if:0

However it's probably more clear to separate your filter rules
from your natting.  You use match to do your natting, which
is sticky.

Put this at the top and get rid of the binat part of the
pass rule:

match on $ext_if from $controller to any binat-to $ext_if:0


Karl k...@meme.com
Free Software:  You don't pay back, you pay forward.
 -- Robert A. Heinlein