From owner-freebsd-pf@FreeBSD.ORG Fri May 9 09:58:13 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6293A1065678 for ; Fri, 9 May 2008 09:58:13 +0000 (UTC) (envelope-from daniel@roe.ch) Received: from hobbes.ustdmz.roe.ch (hobbes.roe.ch [213.144.141.27]) by mx1.freebsd.org (Postfix) with ESMTP id D93E28FC29 for ; Fri, 9 May 2008 09:58:12 +0000 (UTC) (envelope-from daniel@roe.ch) Received: from roe by hobbes.ustdmz.roe.ch (envelope-from ) with LOCAL id 1JuPN1-0004q9-00 ; Fri, 09 May 2008 11:58:31 +0200 Date: Fri, 9 May 2008 11:58:31 +0200 From: Daniel Roethlisberger To: Elliott Perrin Message-ID: <20080509095831.GB14550@hobbes.ustdmz.roe.ch> Mail-Followup-To: Elliott Perrin , freebsd-pf@freebsd.org References: <48222786.3050400@samoylyk.sumy.ua> <20080508085234.2cac29ca@twoflower.in.publishing.hu> <4822B459.6090307@samoylyk.sumy.ua> <20080508101252.4d25b9eb@twoflower.in.publishing.hu> <4822BB8A.8030507@samoylyk.sumy.ua> <1210237122.5607.149.camel@kensho.c7.ca> <20080508113524.GA7168@hobbes.ustdmz.roe.ch> <1210299343.28559.31.camel@kensho.c7.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1210299343.28559.31.camel@kensho.c7.ca> User-Agent: Mutt/1.5.4i Cc: freebsd-pf@freebsd.org Subject: Re: iptables rule in pf X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 May 2008 09:58:13 -0000 Elliott Perrin 2008-05-08: > On Thu, 2008-05-08 at 13:35 +0200, Daniel Roethlisberger wrote: > > Elliott Perrin 2008-05-08: > > > On Thu, 2008-05-08 at 11:36 +0300, Oleksandr Samoylyk wrote: > > > > CZUCZY Gergely wrote: > > > > > On Thu, 08 May 2008 11:05:45 +0300 Oleksandr Samoylyk > > > > > wrote: > > > > >> CZUCZY Gergely wrote: > > > > >>> On Thu, 08 May 2008 01:04:54 +0300 Oleksandr Samoylyk > > > > >>> wrote: > > > > >>>> Dear Community, > > > > >>>> > > > > >>>> I want to move some of our firewalls from Linux/iptables to > > > > >>>> FreeBSD/pf. > > > > >>>> > > > > >>>> After reading man pf.conf for a couple of minutes I > > > > >>>> couldn't find the realization of such iptables rule in pf: > > > > >>>> > > > > >>>> iptables -t nat -A PREROUTING -i ethX -d ! my.smtp.server > > > > >>>> -p tcp --dport 25 -j DROP > > > > >>> block in on $interface proto tcp from any to ! > > > > >>> my.smtp.server port 25 > > > > >>> > > > > >>>> iptables -t nat -A PREROUTING -i ethX -p tcp --dport 2525 > > > > >>>> -j DNAT --to-destination :25 > > > > >>> rdr on $interface proto tcp from any to port 2525 -> > > > > >>> port 25 > > > > >> I meant _any_ destination with 25 port. > > > > >> > > > > >> That iptables rule worked for any destination. > > > > > You cannot rewrite a packet's destination address to _any_ > > > > > destination. > > > > > > > > > > It's like you cannot submit a package at the post office with > > > > > the destination address "any". It's just meaningless. > > > > > > > > However it works with iptables. :) > > > > > > > > What can I do in my situation in order to gain the same > > > > functionality by means of pf or other additional daemons? > > > > > > It doesn't just "work" in iptables. All you are doing is PAT with > > > that rule, rewriting destination ports. What does your DNAT table > > > look like where packets matching this rule then jump to? [...] > > > > Your analysis of the two provided netfilter rules is wrong. DNAT is > > a built-in pseudo-chain which does the actual destination > > address/port translation, in this case it rewrites the destination > > port to 25 and leaves the destination address untouched. > > > > Just to clear up some of the terms used with netfilter: you don't > > jump to tables, you jump to chains. Tables in netfilter are "nat", > > "filter" and "mangle"; like parallel worlds with their own set of > > chains, each table having a distinct purpose (packet filtering, > > address/port translations, and other packet mangling/tagging). > > > > I was not sure if DNAT was a built in or not. As far as the difference > between tables / chains, thanks for clearing that up. I have not > firewalled with ipchains/iptables for quite some time so I am not > completely up to speed on the semantics surrounding the software's > current incarnation. If having used incorrect terminology resulted in > difficulties I apologize. > > However, from a processing perspective my analysis is correct in > concept. The second rule does a port address translation switching the > destination port from port 2525 to port 25 on packets that match the > rule. > [...] You are right in that aspect, I apologize for my bad choice of words. -- Daniel Roethlisberger http://daniel.roe.ch/