From owner-freebsd-pf@FreeBSD.ORG  Fri Jun 15 19:30:48 2007
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 4CB6216A41F
	for <freebsd-pf@freebsd.org>; Fri, 15 Jun 2007 19:30:48 +0000 (UTC)
	(envelope-from fox@verio.net)
Received: from dfw-smtpout1.email.verio.net (dfw-smtpout1.email.verio.net
	[129.250.36.41])
	by mx1.freebsd.org (Postfix) with ESMTP id 2593213C447
	for <freebsd-pf@freebsd.org>; Fri, 15 Jun 2007 19:30:48 +0000 (UTC)
	(envelope-from fox@verio.net)
Received: from [129.250.36.63] (helo=dfw-mmp3.email.verio.net)
	by dfw-smtpout1.email.verio.net with esmtp id 1HzHVP-00014t-LQ
	for freebsd-pf@freebsd.org; Fri, 15 Jun 2007 19:30:47 +0000
Received: from [129.250.40.241] (helo=limbo.int.dllstx01.us.it.verio.net)
	by dfw-mmp3.email.verio.net with esmtp id 1HzHVP-0007Ol-GO
	for freebsd-pf@freebsd.org; Fri, 15 Jun 2007 19:30:47 +0000
Received: by limbo.int.dllstx01.us.it.verio.net (Postfix, from userid 1000)
	id CA5098E296; Fri, 15 Jun 2007 14:30:46 -0500 (CDT)
Date: Fri, 15 Jun 2007 14:30:46 -0500
From: David DeSimone <fox@verio.net>
To: freebsd-pf@freebsd.org
Message-ID: <20070615193046.GD21747@verio.net>
References: <8142b02f0706151122s2775911fme30e79f67e4da625@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii; x-action=pgp-signed
Content-Disposition: inline
In-Reply-To: <8142b02f0706151122s2775911fme30e79f67e4da625@mail.gmail.com>
User-Agent: Mutt/1.5.9i
Subject: Re: pf version 3.7 on freebsd
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 15 Jun 2007 19:30:48 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Leandro Malaquias <lm.net.security@gmail.com> wrote:
>
> I've heard that the pf version being used on freebsd 6-stable is 3.7 so the
> features "pass" and "log" when using "rdr" won't work.

"pass" works, but "log" does not.

You can work around this by forgoing "pass" and instead use "tag" to add
a NAT tag to your redirected packets, then create a "pass" rule which
passes and logs the resultant traffic.

    rdr on $EXT_IF proto tcp from x.x.x.x to y.y.y.y port zz \
	tag REDIRECT -> w.w.w.w

    pass in log quick on $EXT_IF all tagged REDIRECT

- -- 
David DeSimone == Network Admin == fox@verio.net
  "It took me fifteen years to discover that I had no
   talent for writing, but I couldn't give it up because
   by that time I was too famous.  -- Robert Benchley
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFGcujmFSrKRjX5eCoRAmqhAJ4/FeplWFekEhytmIPF8I4GERkRmQCeNh58
X5luzos0BKO1ZRB0FVUzNdQ=
=p3Vi
-----END PGP SIGNATURE-----