From owner-freebsd-pf@FreeBSD.ORG Thu May 8 08:16:22 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1F63E1065671 for ; Thu, 8 May 2008 08:16:22 +0000 (UTC) (envelope-from jille@quis.cx) Received: from smtp1.versatel.nl (smtp1.versatel.nl [62.58.50.88]) by mx1.freebsd.org (Postfix) with ESMTP id 7BB408FC15 for ; Thu, 8 May 2008 08:16:21 +0000 (UTC) (envelope-from jille@quis.cx) Received: (qmail 16764 invoked by uid 0); 8 May 2008 08:16:19 -0000 Received: from ip83-113-174-82.adsl2.versatel.nl (HELO istud.quis.cx) ([82.174.113.83]) (envelope-sender ) by smtp1.versatel.nl (qmail-ldap-1.03) with SMTP for < >; 8 May 2008 08:16:19 -0000 Received: by istud.quis.cx (Postfix, from userid 100) id 6AE1F39825; Thu, 8 May 2008 10:16:18 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on istud.quis.cx X-Spam-Level: X-Spam-Status: No, score=-4.2 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00 autolearn=ham version=3.2.4 Received: from [192.168.1.3] (hic [192.168.1.3]) by istud.quis.cx (Postfix) with ESMTP id EB01139819; Thu, 8 May 2008 10:16:15 +0200 (CEST) Message-ID: <4822B6CC.1080502@quis.cx> Date: Thu, 08 May 2008 10:16:12 +0200 From: Jille User-Agent: Thunderbird 2.0.0.14 (Windows/20080421) MIME-Version: 1.0 To: CZUCZY Gergely References: <48222786.3050400@samoylyk.sumy.ua> <20080508085234.2cac29ca@twoflower.in.publishing.hu> <4822B459.6090307@samoylyk.sumy.ua> <20080508101252.4d25b9eb@twoflower.in.publishing.hu> In-Reply-To: <20080508101252.4d25b9eb@twoflower.in.publishing.hu> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-pf@freebsd.org Subject: Re: iptables rule in pf X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 May 2008 08:16:22 -0000 CZUCZY Gergely schreef: > On Thu, 08 May 2008 11:05:45 +0300 > Oleksandr Samoylyk wrote: > > >> CZUCZY Gergely wrote: >> >>> On Thu, 08 May 2008 01:04:54 +0300 >>> Oleksandr Samoylyk wrote: >>> >>> >>>> Dear Community, >>>> >>>> I want to move some of our firewalls from Linux/iptables to FreeBSD/pf. >>>> >>>> After reading man pf.conf for a couple of minutes I couldn't find the >>>> realization of such iptables rule in pf: >>>> >>>> iptables -t nat -A PREROUTING -i ethX -d ! my.smtp.server -p tcp --dport >>>> 25 -j DROP >>>> >>> block in on $interface proto tcp from any to ! my.smtp.server port 25 >>> >>> >>>> iptables -t nat -A PREROUTING -i ethX -p tcp --dport 2525 -j DNAT >>>> --to-destination :25 >>>> >>> rdr on $interface proto tcp from any to port 2525 -> >>> port 25 >>> >> I meant _any_ destination with 25 port. >> >> That iptables rule worked for any destination. >> > You cannot rewrite a packet's destination address to _any_ destination. > > It's like you cannot submit a package at the post office with the destination > address "any". It's just meaningless. > I think he only want to 'change' the port-number, and don't touch the destination address. You could try: rdr on $interface proto tcp from any to port 2525 -> port 25 But that's a wild guess (I'm *not* sure) -- Jille > >>>> How it can be rewriting in pf.conf? >>>> >>> be sure to read the openbsd faq: >>> http://www.openbsd.org/faq/pf >>> >>> pf works quite differently then iptables, it has a different logic. you will >>> get used to it. just forget these "tables" which you've got used to with >>> iptables. >>> >>> > > >