Date: Thu, 08 May 2008 11:36:26 +0300 From: Oleksandr Samoylyk <oleksandr@samoylyk.sumy.ua> To: CZUCZY Gergely <gergely.czuczy@harmless.hu> Cc: freebsd-pf@freebsd.org Subject: Re: iptables rule in pf Message-ID: <4822BB8A.8030507@samoylyk.sumy.ua> In-Reply-To: <20080508101252.4d25b9eb@twoflower.in.publishing.hu> References: <48222786.3050400@samoylyk.sumy.ua> <20080508085234.2cac29ca@twoflower.in.publishing.hu> <4822B459.6090307@samoylyk.sumy.ua> <20080508101252.4d25b9eb@twoflower.in.publishing.hu>
next in thread | previous in thread | raw e-mail | index | archive | help
CZUCZY Gergely wrote: > On Thu, 08 May 2008 11:05:45 +0300 > Oleksandr Samoylyk <oleksandr@samoylyk.sumy.ua> wrote: > >> CZUCZY Gergely wrote: >>> On Thu, 08 May 2008 01:04:54 +0300 >>> Oleksandr Samoylyk <oleksandr@samoylyk.sumy.ua> wrote: >>> >>>> Dear Community, >>>> >>>> I want to move some of our firewalls from Linux/iptables to FreeBSD/pf. >>>> >>>> After reading man pf.conf for a couple of minutes I couldn't find the >>>> realization of such iptables rule in pf: >>>> >>>> iptables -t nat -A PREROUTING -i ethX -d ! my.smtp.server -p tcp --dport >>>> 25 -j DROP >>> block in on $interface proto tcp from any to ! my.smtp.server port 25 >>> >>>> iptables -t nat -A PREROUTING -i ethX -p tcp --dport 2525 -j DNAT >>>> --to-destination :25 >>> rdr on $interface proto tcp from any to port 2525 -> >>> <the_destionation_you_have_omitted> port 25 >> I meant _any_ destination with 25 port. >> >> That iptables rule worked for any destination. > You cannot rewrite a packet's destination address to _any_ destination. > > It's like you cannot submit a package at the post office with the destination > address "any". It's just meaningless. > However it works with iptables. :) What can I do in my situation in order to gain the same functionality by means of pf or other additional daemons? -- Oleksandr Samoylyk OVS-RIPE
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4822BB8A.8030507>