From owner-freebsd-pf@FreeBSD.ORG  Tue Mar  1 23:14:19 2005
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B62A316A4CE
	for <freebsd-pf@freebsd.org>; Tue,  1 Mar 2005 23:14:19 +0000 (GMT)
Received: from rwcrmhc11.comcast.net (rwcrmhc11.comcast.net [204.127.198.35])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7C90143D39
	for <freebsd-pf@freebsd.org>; Tue,  1 Mar 2005 23:14:19 +0000 (GMT)
	(envelope-from fbsd-pf@trini0.org)
Received: from hivemind.trini0.org ([65.34.205.195])
          by comcast.net (rwcrmhc11) with ESMTP
          id <2005030123141901300qmqhse>; Tue, 1 Mar 2005 23:14:19 +0000
Received: from [192.168.0.16] (gladiator.trini0.org [192.168.0.16])
	by hivemind.trini0.org (Postfix) with ESMTP id D21126112
	for <freebsd-pf@freebsd.org>; Tue,  1 Mar 2005 18:14:18 -0500 (EST)
Message-ID: <4224F74B.1030502@trini0.org>
Date: Tue, 01 Mar 2005 18:14:19 -0500
From: Gerard Samuel <fbsd-pf@trini0.org>
User-Agent: Mozilla Thunderbird 1.0 (X11/20050122)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: freebsd-pf@freebsd.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Whats wrong with this ruleset?
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Technical discussion and general questions about packet filter (pf)
	<freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Mar 2005 23:14:19 -0000

For some reason, port 53 is blocked going out of the external interface ->
000000 rule 0/0(match): block out on ed0: IP xx.xxx.xxx.xx.53 > 
xx.xx.xx.xxx.4973

Im still new to pf, but shouldn't the last two lines allow anything 
going out
to pass??
Any ideas on how to fix?
Thanks for your time

----
# macros
int_if = "fxp0"
ext_if = "ed0"

tcp_services = "{ 22, 113 }"
icmp_types = "echoreq"

priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"

hivemind = "192.168.0.2"
www      = "10.0.0.1"

isp_dhcp = "xx.xx.xx.xx"

# options
set block-policy return
set loginterface $ext_if

# scrub
scrub in all

# nat/rdr
nat on $ext_if from $int_if:network to any -> ($ext_if)

rdr on $ext_if proto tcp from any to any port 22 -> $hivemind
rdr on $ext_if proto tcp from any to any port 25 -> $hivemind
rdr on $ext_if proto tcp from any to any port 80 -> $www
rdr on $ext_if proto tcp from any to any port 110 -> $hivemind


# filter rules
block log all

pass quick on lo0 all

block drop in  quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets

pass in on $ext_if inet proto tcp from any to ($ext_if) port 
$tcp_services flags S/SA keep state

pass in on $ext_if proto {udp} from $isp_dhcp to any port 68

pass in on $ext_if proto {tcp} from any to any port 22

pass in on $ext_if proto {tcp, udp} from any to any port 53

pass in on $ext_if proto {tcp} from any to any port 25
pass in on $ext_if proto {tcp} from any to any port 110

pass in on $ext_if proto tcp from any to $www port 80 flags S/SA 
synproxy state

pass in inet proto icmp all icmp-type $icmp_types keep state

pass in on $int_if from $int_if:network to any keep state
pass out on $int_if from any to $int_if:network keep state

pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto {udp, icmp} all keep state