From owner-freebsd-pf@FreeBSD.ORG Fri Feb 5 23:19:25 2010 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 48893106566B for ; Fri, 5 Feb 2010 23:19:25 +0000 (UTC) (envelope-from mauduro@gmail.com) Received: from mail-ww0-f54.google.com (mail-ww0-f54.google.com [74.125.82.54]) by mx1.freebsd.org (Postfix) with ESMTP id CCE5F8FC16 for ; Fri, 5 Feb 2010 23:19:24 +0000 (UTC) Received: by wwj40 with SMTP id 40so706001wwj.13 for ; Fri, 05 Feb 2010 15:19:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=PvYYBXFbLyv/0yB/ePC9m1jcLkYvUMCbRGaom5Gkp9o=; b=NYquNyivMOU9rnU5/WWv1+KylDgSAobTjHXzhB9Q4GtRidGkDJEvlauM/xVhli51V6 ZjrKQGHyStAb/cUKHFL7kMnrniXWQcTyk+qFimH41F/hL0WVdC0DectVXmQwEIFuKZjX VCjtxzMexRo1yoAlQzNDASxJJEezqwtsai75Y= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=xP9p91bbyulrofmOadnlUOVBa/mxn8j83lbXQ7z2Na1enWpYQw9pnG37/c1ZSl00N1 j7O1ecoeyvSOsj19COMxRwS0YOVcJ204xr1x8kYeAlMaCUXKjOd19hs2qoaCxYK3Dh9V WCu0ujgqjIba3wx690lfmHgXzIJe6DhySjVwA= MIME-Version: 1.0 Received: by 10.216.90.195 with SMTP id e45mr1893316wef.189.1265410394750; Fri, 05 Feb 2010 14:53:14 -0800 (PST) Date: Fri, 5 Feb 2010 15:53:14 -0700 Message-ID: From: Maurice To: freebsd-pf@freebsd.org Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Subject: using pf to NAT with only one NIC X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Feb 2010 23:19:25 -0000 Hi, I have been looking for a couple days now, with no luck, for some direction as to whether I can successfully configure my freebsd to NAT with only one NIC. This is because I am setting up my system to jail my webserver, and I don't think I can get it to work without NATting it. If you have an alternate solution that would be great too. This is what my pf.conf looks like right now: # $FreeBSD: src/share/examples/pf/pf.conf,v 1.1.2.1.6.1 2009/04/15 03:14:26 kensmith Exp $ # $OpenBSD: pf.conf,v 1.34 2007/02/24 19:30:59 millert Exp $ # # See pf.conf(5) and /usr/share/examples/pf for syntax and examples. # Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1 # in /etc/sysctl.conf if packets are to be forwarded between interfaces. block in all block out all ext_if="fxp0" #int_if="int0" all_if="{fxp0, lo0}" #Internal network subnet int_net="10.0.0.0/32" #name and IP of webserver APACHE="10.0.0.1" #table persist set skip on lo scrub in #nat-anchor "ftp-proxy/*" #rdr-anchor "ftp-proxy/*" #nat on $ext_if from !($ext_if) -> ($ext_if:0) #rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021 #no rdr on $ext_if proto tcp from to any port smtp #rdr pass on $ext_if proto tcp from any to any port smtp \ # -> 127.0.0.1 port spamd #anchor "ftp-proxy/*" #pass out #pass quick on $int_if no state #antispoof quick for { lo $int_if } block in quick from urpf-failed pass in on $ext_if proto tcp to ($ext_if) port ssh synproxy state rdr on $all_if proto tcp from any to fxp0 port 80 -> $APACHE port 80 nat on $ext_if from $APACHE to any -> fxp0 #pass in log on $ext_if proto tcp to ($ext_if) port smtp #pass out log on $ext_if proto tcp from ($ext_if) to port smtp That doesn't seem to be doing the trick, since I can't ping and DNS won't resolve anything from within the jail (APACHE). I am going off some examples I found that would seem to suggest it is possible with only one NIC, but I can't seem to get it to work. Any help/advice would be greatly appreciated. thanks, Maurice