From owner-freebsd-questions@freebsd.org Mon Mar 28 20:23:05 2016 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id A9888AE022C for ; Mon, 28 Mar 2016 20:23:05 +0000 (UTC) (envelope-from tyler@tysdomain.com) Received: from tds-solutions.net (tds-solutions.net [174.136.96.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 90EBC105E for ; Mon, 28 Mar 2016 20:23:05 +0000 (UTC) (envelope-from tyler@tysdomain.com) Received: from tds-solutions.net (localhost [127.0.0.1]) by tds-solutions.net (Postfix) with ESMTP id 7AB22208783C for ; Mon, 28 Mar 2016 16:23:04 -0400 (EDT) X-Virus-Scanned: amavisd-new at tds-solutions.net Received: from tds-solutions.net ([127.0.0.1]) by tds-solutions.net (tds-solutions.net [127.0.0.1]) (amavisd-new, port 10024) with LMTP id FbJNvSIWvY8v for ; Mon, 28 Mar 2016 16:23:04 -0400 (EDT) Received: from [10.21.96.50] (c-24-147-10-153.hsd1.ma.comcast.net [24.147.10.153]) (Authenticated sender: sorressean) by tds-solutions.net (Postfix) with ESMTPSA id E14D520877BA for ; Mon, 28 Mar 2016 16:23:03 -0400 (EDT) Reply-To: tyler@tysdomain.com To: freebsd-questions@freebsd.org From: "Littlefield, Tyler" Subject: question re: PF and forwarding Message-ID: <56F992AA.7070409@tysdomain.com> Date: Mon, 28 Mar 2016 16:23:06 -0400 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.7.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Mar 2016 20:23:05 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, sorry for the multiple emails recently. I'm working to get my server set up here so I can begin doing some dev on BHyve once that is all finalized. I am jailing my services like minidlna samba and unbound and am using PF to forward those. For whatever reason I do not see the ports I specify as open ports, but the individual addresses show them when I connect from within my server. For example, I can telnet 192.168.0.2 445 and that works fine in terms of establishing a connection. I was hoping that someone might see any connection here. Here is my pf.conf. *** if="igb0" addr="10.21.96.128" samba_addr="192.168.0.2" dlna_addr="192.168.0.3" unbound_addr="192.168.0.4" tcp_services="{ssh 53 netbios-ns netbios-dgm netbios-ssn microsoft-ds}" udp_services="{53 netbios-ns netbios-dgm netbios-ssn microsoft-ds}" set skip on lo set loginterface $if scrub in all #allow jails through nat on $if inet from $samba_addr to any tag jail_samba -> $addr nat on $if inet from $dlna_addr to any tag jail_dlna -> $addr nat on $if inet from $unbound_addr to any tag jail_unbound -> $addr #portforward to jails. #unbound rdr pass on $if proto tcp from any to $addr port 53 -> $unbound_addr port 53 rdr pass on $if proto udp from any to $addr port 53 -> $unbound_addr port 53 #samba rdr pass on $if proto tcp from any to $addr port 137 -> $samba_addr port 137 rdr pass on $if proto tcp from any to $addr port 138 -> $samba_addr port 138 rdr pass on $if proto tcp from any to $addr port 139 -> $samba_addr port 139 rdr pass on $if proto tcp from any to $addr port 445 -> $samba_addr port 445 rdr pass on $if proto udp from any to $addr port 137 -> $samba_addr port 137 rdr pass on $if proto udp from any to $addr port 138 -> $samba_addr port 138 rdr pass on $if proto udp from any to $addr port 139 -> $samba_addr port 139 rdr pass on $if proto udp from any to $addr port 445 -> $samba_addr port 445 #rules pass quick on lo1 pass from igb0:network to any keep state #default policy: deny antispoof quick for { $if lo } block in all #accept TCP ports. pass in on $if proto tcp from any to any port $tcp_services pass in on $if proto udp from any to any port $udp_services *** - -- Take care, Ty Twitter: @sorressean Web: https://tysdomain.com Pubkey: https://tysdomain.com/files/pubkey.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBAgAGBQJW+ZKqAAoJEAdP60+BYxejccoIAJXdhyvB15PtXyBeA7K0e5tR MIP6SVWmdWpv/9AxPAodPvHgTiyJF4A50VsJ9Tcnq8v0gnulIKXytlBHwuJe0goI b8vJT+Sqq6d6ystnhGddh1npgHbwD8LwP5s7AA6LIhFxq84GIprC22+HCi/tTHXF AGX408PNJbNXXwA5F/tzBQH2uFXUA28d6NKkeOjrKkIn5ZwCB57ehmDO/3yNhZHT ONvzK83QbyYU2q+BRYIkqPNzpXIQgPGIULMHj57jymOZqdjDd6llSvmWdKWkhv9d BIRDcd513n+GjYc4fCzwTh110EOhC47IbBTK09l3SCgcvbztTKx0m1vQvNQk73Y= =Lvnv -----END PGP SIGNATURE-----