From owner-freebsd-pf@FreeBSD.ORG  Thu May  8 08:36:38 2008
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 2C96F1065673
	for <freebsd-pf@freebsd.org>; Thu,  8 May 2008 08:36:38 +0000 (UTC)
	(envelope-from oleksandr@samoylyk.sumy.ua)
Received: from mail.telesweet.net (news.telesweet.net [194.110.252.16])
	by mx1.freebsd.org (Postfix) with ESMTP id D4AF88FC0C
	for <freebsd-pf@freebsd.org>; Thu,  8 May 2008 08:36:37 +0000 (UTC)
	(envelope-from oleksandr@samoylyk.sumy.ua)
Received: from localhost (localhost [127.0.0.1])
	by mail.telesweet.net (Postfix) with ESMTP id E7041C435;
	Thu,  8 May 2008 11:36:35 +0300 (EEST)
X-Virus-Scanned: by Telesweet Mail Virus Scanner
X-Spam-Flag: NO
X-Spam-Score: -1.44
X-Spam-Level: 
X-Spam-Status: No, score=-1.44 tagged_above=-999 required=5
	tests=[ALL_TRUSTED=-1.44]
Received: from [10.0.0.109] (pigeon-work.telesweet [10.0.0.109])
	by mail.telesweet.net (Postfix) with ESMTP id C573BB81A;
	Thu,  8 May 2008 11:36:22 +0300 (EEST)
Message-ID: <4822BB8A.8030507@samoylyk.sumy.ua>
Date: Thu, 08 May 2008 11:36:26 +0300
From: Oleksandr Samoylyk <oleksandr@samoylyk.sumy.ua>
User-Agent: Thunderbird 2.0.0.14 (X11/20080505)
MIME-Version: 1.0
To: CZUCZY Gergely <gergely.czuczy@harmless.hu>
References: <48222786.3050400@samoylyk.sumy.ua>	<20080508085234.2cac29ca@twoflower.in.publishing.hu>	<4822B459.6090307@samoylyk.sumy.ua>
	<20080508101252.4d25b9eb@twoflower.in.publishing.hu>
In-Reply-To: <20080508101252.4d25b9eb@twoflower.in.publishing.hu>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-pf@freebsd.org
Subject: Re: iptables rule in pf
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 May 2008 08:36:38 -0000

CZUCZY Gergely wrote:
> On Thu, 08 May 2008 11:05:45 +0300
> Oleksandr Samoylyk <oleksandr@samoylyk.sumy.ua> wrote:
> 
>> CZUCZY Gergely wrote:
>>> On Thu, 08 May 2008 01:04:54 +0300
>>> Oleksandr Samoylyk <oleksandr@samoylyk.sumy.ua> wrote:
>>>
>>>> Dear Community,
>>>>
>>>> I want to move some of our firewalls from Linux/iptables to FreeBSD/pf.
>>>>
>>>> After reading man pf.conf for a couple of minutes I couldn't find the
>>>> realization of such iptables rule in pf:
>>>>
>>>> iptables -t nat -A PREROUTING -i ethX -d ! my.smtp.server -p tcp --dport
>>>> 25 -j DROP
>>> block in on $interface proto tcp from any to ! my.smtp.server port 25
>>>
>>>> iptables -t nat -A PREROUTING -i ethX -p tcp --dport 2525 -j DNAT
>>>> --to-destination :25
>>> rdr on $interface proto tcp from any to port 2525 ->
>>> <the_destionation_you_have_omitted> port 25
>> I meant _any_ destination with 25 port.
>>
>> That iptables rule worked for any destination.
> You cannot rewrite a packet's destination address to _any_ destination.
> 
> It's like you cannot submit a package at the post office with the destination
> address "any". It's just meaningless.
> 

However it works with iptables. :)

What can I do in my situation in order to gain the same functionality by 
means of pf or other additional daemons?

-- 
  Oleksandr Samoylyk
  OVS-RIPE