From owner-freebsd-pf@FreeBSD.ORG  Thu May  8 06:52:39 2008
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 910F8106567F
	for <freebsd-pf@freebsd.org>; Thu,  8 May 2008 06:52:39 +0000 (UTC)
	(envelope-from phoemix@harmless.hu)
Received: from marvin.harmless.hu (www.ssl.harmless.hu [195.56.55.205])
	by mx1.freebsd.org (Postfix) with ESMTP id 4953E8FC17
	for <freebsd-pf@freebsd.org>; Thu,  8 May 2008 06:52:39 +0000 (UTC)
	(envelope-from phoemix@harmless.hu)
Received: from fw.publishing.hu ([82.131.181.62]
	helo=twoflower.in.publishing.hu)
	by marvin.harmless.hu with esmtpsa (TLSv1:AES256-SHA:256)
	(Exim 4.69 (FreeBSD)) (envelope-from <phoemix@harmless.hu>)
	id 1JtzzZ-000K9o-4J; Thu, 08 May 2008 08:52:37 +0200
Date: Thu, 8 May 2008 08:52:34 +0200
From: CZUCZY Gergely <gergely.czuczy@harmless.hu>
To: Oleksandr Samoylyk <oleksandr@samoylyk.sumy.ua>
Message-ID: <20080508085234.2cac29ca@twoflower.in.publishing.hu>
In-Reply-To: <48222786.3050400@samoylyk.sumy.ua>
References: <48222786.3050400@samoylyk.sumy.ua>
Organization: Harmless Digital
X-Mailer: Claws Mail 3.3.1 (GTK+ 2.10.11; i386-portbld-freebsd6.2)
Mime-Version: 1.0
Content-Type: multipart/signed; boundary="Sig_/=L5Buy3.2NiRU63BpbvyJZu";
	protocol="application/pgp-signature"; micalg=PGP-SHA1
Sender: Czuczy Gergely <phoemix@harmless.hu>
Cc: freebsd-pf@freebsd.org
Subject: Re: iptables rule in pf
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 May 2008 06:52:39 -0000

--Sig_/=L5Buy3.2NiRU63BpbvyJZu
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable


On Thu, 08 May 2008 01:04:54 +0300
Oleksandr Samoylyk <oleksandr@samoylyk.sumy.ua> wrote:

> Dear Community,
>=20
> I want to move some of our firewalls from Linux/iptables to FreeBSD/pf.
>=20
> After reading man pf.conf for a couple of minutes I couldn't find the
> realization of such iptables rule in pf:
>=20
> iptables -t nat -A PREROUTING -i ethX -d ! my.smtp.server -p tcp --dport
> 25 -j DROP
block in on $interface proto tcp from any to ! my.smtp.server port 25

> iptables -t nat -A PREROUTING -i ethX -p tcp --dport 2525 -j DNAT
> --to-destination :25
rdr on $interface proto tcp from any to port 2525 ->
<the_destionation_you_have_omitted> port 25

> How it can be rewriting in pf.conf?
be sure to read the openbsd faq:
http://www.openbsd.org/faq/pf

pf works quite differently then iptables, it has a different logic. you will
get used to it. just forget these "tables" which you've got used to with
iptables.

--=20
Sincerely,

CZUCZY Gergely
Harmless Digital Bt
mailto: gergely.czuczy@harmless.hu
Tel: +36-30-9702963

--Sig_/=L5Buy3.2NiRU63BpbvyJZu
Content-Type: application/pgp-signature; name=signature.asc
Content-Disposition: attachment; filename=signature.asc

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.3 (FreeBSD)

iD8DBQFIIqM0zrC0WyuMkpsRAuXBAJ45VB7boCA17y6Jbu63P6446PNjbwCdEuAE
Gou47R0Ev0cRMjJeCJUS0kA=
=nKPD
-----END PGP SIGNATURE-----

--Sig_/=L5Buy3.2NiRU63BpbvyJZu--