Date: Mon, 31 Oct 2011 15:30:05 +0100 From: =?UTF-8?Q?G=C3=B3t_Andr=C3=A1s?= <andrej@antiszoc.hu> To: <freebsd-stable@freebsd.org> Subject: Re: pf rdr rule question - corrected Message-ID: <a0179b06242cd2f88ac2218870126a35@antiszoc.hu> In-Reply-To: <4EAE6538.4030001@my.gd> References: <c677c67c90aed9e568895aaee0039732@antiszoc.hu> <4EAE6538.4030001@my.gd>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 31 Oct 2011 10:07:04 +0100, Damien Fleuriot wrote: > On 10/31/11 12:04 AM, Gót András wrote: >> Dear All, >> >> I'd like to have the following ruleset, for pure-ftpd passive port >> range: >> >> (pasv and past mistyping corrected) >> >> --- >> ftp_pasv_start="X" >> ftp_pasv_end="Y" >> >> rdr on $netif inet proto tcp from any to $internalip port >> $ftp_pasv_start:$ftp_pasv_end -> $internalip >> >> pass in quick on $netif proto tcp from any to $internalip port >> $ftp_pasv_start >< $ftp_pasv_end keep state flags S/SA >> > > pass in quick on $netif proto tcp from any to $internalip port > $ftp_pasv_start:$ftp_pasv_end > > > Both keep state and flags S/SA are default, you don't need to write > them. My problem is with the rdr rule, that the second macro won't get evaluated correctly. I just copied the stateful match rule, to make it more clear that with a pair of macros it's easier to set up. FreeBSD version is 8.2. Regards, Andras
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?a0179b06242cd2f88ac2218870126a35>