From owner-freebsd-pf@FreeBSD.ORG Thu May 8 08:12:57 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EB12A1065684 for ; Thu, 8 May 2008 08:12:57 +0000 (UTC) (envelope-from phoemix@harmless.hu) Received: from marvin.harmless.hu (www.ssl.harmless.hu [195.56.55.205]) by mx1.freebsd.org (Postfix) with ESMTP id A18898FC0A for ; Thu, 8 May 2008 08:12:57 +0000 (UTC) (envelope-from phoemix@harmless.hu) Received: from fw.publishing.hu ([82.131.181.62] helo=twoflower.in.publishing.hu) by marvin.harmless.hu with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ju1FI-000Lux-Af; Thu, 08 May 2008 10:12:56 +0200 Date: Thu, 8 May 2008 10:12:52 +0200 From: CZUCZY Gergely To: Oleksandr Samoylyk Message-ID: <20080508101252.4d25b9eb@twoflower.in.publishing.hu> In-Reply-To: <4822B459.6090307@samoylyk.sumy.ua> References: <48222786.3050400@samoylyk.sumy.ua> <20080508085234.2cac29ca@twoflower.in.publishing.hu> <4822B459.6090307@samoylyk.sumy.ua> Organization: Harmless Digital X-Mailer: Claws Mail 3.3.1 (GTK+ 2.10.11; i386-portbld-freebsd6.2) Mime-Version: 1.0 Content-Type: multipart/signed; boundary="Sig_/V4Xpv67TkFgRf=DFF1.N8Bq"; protocol="application/pgp-signature"; micalg=PGP-SHA1 Sender: Czuczy Gergely Cc: freebsd-pf@freebsd.org Subject: Re: iptables rule in pf X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 May 2008 08:12:58 -0000 --Sig_/V4Xpv67TkFgRf=DFF1.N8Bq Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Thu, 08 May 2008 11:05:45 +0300 Oleksandr Samoylyk wrote: > CZUCZY Gergely wrote: > > On Thu, 08 May 2008 01:04:54 +0300 > > Oleksandr Samoylyk wrote: > >=20 > >> Dear Community, > >> > >> I want to move some of our firewalls from Linux/iptables to FreeBSD/pf. > >> > >> After reading man pf.conf for a couple of minutes I couldn't find the > >> realization of such iptables rule in pf: > >> > >> iptables -t nat -A PREROUTING -i ethX -d ! my.smtp.server -p tcp --dpo= rt > >> 25 -j DROP > > block in on $interface proto tcp from any to ! my.smtp.server port 25 > >=20 > >> iptables -t nat -A PREROUTING -i ethX -p tcp --dport 2525 -j DNAT > >> --to-destination :25 > > rdr on $interface proto tcp from any to port 2525 -> > > port 25 >=20 > I meant _any_ destination with 25 port. >=20 > That iptables rule worked for any destination. You cannot rewrite a packet's destination address to _any_ destination. It's like you cannot submit a package at the post office with the destinati= on address "any". It's just meaningless. >=20 > >> How it can be rewriting in pf.conf? > > be sure to read the openbsd faq: > > http://www.openbsd.org/faq/pf > >=20 > > pf works quite differently then iptables, it has a different logic. you= will > > get used to it. just forget these "tables" which you've got used to with > > iptables. > >=20 >=20 --=20 =C3=9Cdv=C3=B6lettel, Czuczy Gergely Harmless Digital Bt mailto: gergely.czuczy@harmless.hu Tel: +36-30-9702963 --Sig_/V4Xpv67TkFgRf=DFF1.N8Bq Content-Type: application/pgp-signature; name=signature.asc Content-Disposition: attachment; filename=signature.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.3 (FreeBSD) iD8DBQFIIrYGzrC0WyuMkpsRAiCZAJ0UDnS92X2rwCbxPGu24LFQM8s50ACdFaAN kzy6AVUv+J/ELAVXYWq/SME= =Kvrc -----END PGP SIGNATURE----- --Sig_/V4Xpv67TkFgRf=DFF1.N8Bq--