From owner-freebsd-pf@FreeBSD.ORG  Sat Aug  6 02:01:49 2005
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9AFD216A41F
	for <freebsd-pf@freebsd.org>; Sat,  6 Aug 2005 02:01:49 +0000 (GMT)
	(envelope-from max@love2party.net)
Received: from moutng.kundenserver.de (moutng.kundenserver.de
	[212.227.126.177])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 0C53D43D48
	for <freebsd-pf@freebsd.org>; Sat,  6 Aug 2005 02:01:49 +0000 (GMT)
	(envelope-from max@love2party.net)
Received: from p54A3C947.dip.t-dialin.net [84.163.201.71]
	(helo=donor.laier.local)
	by mrelayeu.kundenserver.de with ESMTP (Nemesis),
	id 0ML25U-1E1E0R0z2U-00018Q; Sat, 06 Aug 2005 04:01:47 +0200
From: Max Laier <max@love2party.net>
To: freebsd-pf@freebsd.org
Date: Sat, 6 Aug 2005 04:01:39 +0200
User-Agent: KMail/1.8
References: <a06230952bf18c2585759@[192.168.1.102]>
In-Reply-To: <a06230952bf18c2585759@[192.168.1.102]>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="nextPart1516606.NgJdkeq6XQ";
	protocol="application/pgp-signature"; micalg=pgp-sha1
Content-Transfer-Encoding: 7bit
Message-Id: <200508060401.45433.max@love2party.net>
X-Provags-ID: kundenserver.de abuse@kundenserver.de
	login:61c499deaeeba3ba5be80f48ecc83056
Cc: Michael Dexter <dexter@ambidexter.com>
Subject: Re: Can rdr rules include flags?
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 06 Aug 2005 02:01:49 -0000

--nextPart1516606.NgJdkeq6XQ
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Michael,

On Friday 05 August 2005 09:25, Michael Dexter wrote:
> This a general PF question but I am using it in the FreeBSD environment.
>
> I am using an rdr rule to forward http traffic to a jail.
>
> rdr pass on $ext_if inet proto tcp from any to $ext_if port 8080 ->
> $www_ad port 80
>
>  From what I can tell, an accompanying "pass" entry such as the
> following is not needed and is perhaps ignored.

yes, unless you remove the pass option from the rdr-rule.

> pass in on $ext_if inet proto tcp from any to $ext_if port 80 flags
> S/SA \ modulate state
>
> Is there any way to apply flags to rdr traffic to limit protocols or port=
s?

Just like that.  Don't apply the pass option on the rdr-rule and use statef=
ul=20
pass/block rules to further limit down the redirection.

=2D-=20
/"\  Best regards,                      | mlaier@freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier@EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News

--nextPart1516606.NgJdkeq6XQ
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (FreeBSD)

iD8DBQBC9BoJXyyEoT62BG0RAu/lAJ9zW+mXTcfFPOnwOTyuLIzYlxHnBQCeMpGQ
QpD2f7LuQP9xjQjPoE8v4mg=
=WXsD
-----END PGP SIGNATURE-----

--nextPart1516606.NgJdkeq6XQ--