From owner-freebsd-pf@FreeBSD.ORG  Thu May  8 08:06:47 2008
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 995B2106564A
	for <freebsd-pf@freebsd.org>; Thu,  8 May 2008 08:06:47 +0000 (UTC)
	(envelope-from oleksandr@samoylyk.sumy.ua)
Received: from mail.telesweet.net (news.telesweet.net [194.110.252.16])
	by mx1.freebsd.org (Postfix) with ESMTP id 4EBAD8FC16
	for <freebsd-pf@freebsd.org>; Thu,  8 May 2008 08:06:46 +0000 (UTC)
	(envelope-from oleksandr@samoylyk.sumy.ua)
Received: from localhost (localhost [127.0.0.1])
	by mail.telesweet.net (Postfix) with ESMTP id 9B95C10028;
	Thu,  8 May 2008 11:06:43 +0300 (EEST)
X-Virus-Scanned: by Telesweet Mail Virus Scanner
X-Spam-Flag: NO
X-Spam-Score: -1.44
X-Spam-Level: 
X-Spam-Status: No, score=-1.44 tagged_above=-999 required=5
	tests=[ALL_TRUSTED=-1.44]
Received: from [10.0.0.109] (pigeon-work.telesweet [10.0.0.109])
	by mail.telesweet.net (Postfix) with ESMTP id B32ACC435;
	Thu,  8 May 2008 11:05:41 +0300 (EEST)
Message-ID: <4822B459.6090307@samoylyk.sumy.ua>
Date: Thu, 08 May 2008 11:05:45 +0300
From: Oleksandr Samoylyk <oleksandr@samoylyk.sumy.ua>
User-Agent: Thunderbird 2.0.0.14 (X11/20080505)
MIME-Version: 1.0
To: CZUCZY Gergely <gergely.czuczy@harmless.hu>
References: <48222786.3050400@samoylyk.sumy.ua>
	<20080508085234.2cac29ca@twoflower.in.publishing.hu>
In-Reply-To: <20080508085234.2cac29ca@twoflower.in.publishing.hu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-pf@freebsd.org
Subject: Re: iptables rule in pf
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 May 2008 08:06:47 -0000

CZUCZY Gergely wrote:
> On Thu, 08 May 2008 01:04:54 +0300
> Oleksandr Samoylyk <oleksandr@samoylyk.sumy.ua> wrote:
> 
>> Dear Community,
>>
>> I want to move some of our firewalls from Linux/iptables to FreeBSD/pf.
>>
>> After reading man pf.conf for a couple of minutes I couldn't find the
>> realization of such iptables rule in pf:
>>
>> iptables -t nat -A PREROUTING -i ethX -d ! my.smtp.server -p tcp --dport
>> 25 -j DROP
> block in on $interface proto tcp from any to ! my.smtp.server port 25
> 
>> iptables -t nat -A PREROUTING -i ethX -p tcp --dport 2525 -j DNAT
>> --to-destination :25
> rdr on $interface proto tcp from any to port 2525 ->
> <the_destionation_you_have_omitted> port 25

I meant _any_ destination with 25 port.

That iptables rule worked for any destination.

>> How it can be rewriting in pf.conf?
> be sure to read the openbsd faq:
> http://www.openbsd.org/faq/pf
> 
> pf works quite differently then iptables, it has a different logic. you will
> get used to it. just forget these "tables" which you've got used to with
> iptables.
> 

-- 
  Oleksandr Samoylyk
  OVS-RIPE