Date: Thu, 8 May 2008 13:35:24 +0200 From: Daniel Roethlisberger <daniel@roe.ch> To: freebsd-pf@freebsd.org Subject: Re: iptables rule in pf Message-ID: <20080508113524.GA7168@hobbes.ustdmz.roe.ch> In-Reply-To: <1210237122.5607.149.camel@kensho.c7.ca> References: <48222786.3050400@samoylyk.sumy.ua> <20080508085234.2cac29ca@twoflower.in.publishing.hu> <4822B459.6090307@samoylyk.sumy.ua> <20080508101252.4d25b9eb@twoflower.in.publishing.hu> <4822BB8A.8030507@samoylyk.sumy.ua> <1210237122.5607.149.camel@kensho.c7.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
Elliott Perrin <elliott@c7.ca> 2008-05-08: > On Thu, 2008-05-08 at 11:36 +0300, Oleksandr Samoylyk wrote: > > CZUCZY Gergely wrote: > > > On Thu, 08 May 2008 11:05:45 +0300 Oleksandr Samoylyk > > > <oleksandr@samoylyk.sumy.ua> wrote: > > >> CZUCZY Gergely wrote: > > >>> On Thu, 08 May 2008 01:04:54 +0300 Oleksandr Samoylyk > > >>> <oleksandr@samoylyk.sumy.ua> wrote: > > >>>> Dear Community, > > >>>> > > >>>> I want to move some of our firewalls from Linux/iptables to > > >>>> FreeBSD/pf. > > >>>> > > >>>> After reading man pf.conf for a couple of minutes I couldn't > > >>>> find the realization of such iptables rule in pf: > > >>>> > > >>>> iptables -t nat -A PREROUTING -i ethX -d ! my.smtp.server -p > > >>>> tcp --dport 25 -j DROP > > >>> block in on $interface proto tcp from any to ! my.smtp.server > > >>> port 25 > > >>> > > >>>> iptables -t nat -A PREROUTING -i ethX -p tcp --dport 2525 -j > > >>>> DNAT --to-destination :25 > > >>> rdr on $interface proto tcp from any to port 2525 -> > > >>> <the_destionation_you_have_omitted> port 25 > > >> I meant _any_ destination with 25 port. > > >> > > >> That iptables rule worked for any destination. > > > You cannot rewrite a packet's destination address to _any_ > > > destination. > > > > > > It's like you cannot submit a package at the post office with the > > > destination address "any". It's just meaningless. > > > > However it works with iptables. :) > > > > What can I do in my situation in order to gain the same > > functionality by means of pf or other additional daemons? > > It doesn't just "work" in iptables. All you are doing is PAT with that > rule, rewriting destination ports. What does your DNAT table look like > where packets matching this rule then jump to? [...] Your analysis of the two provided netfilter rules is wrong. DNAT is a built-in pseudo-chain which does the actual destination address/port translation, in this case it rewrites the destination port to 25 and leaves the destination address untouched. Just to clear up some of the terms used with netfilter: you don't jump to tables, you jump to chains. Tables in netfilter are "nat", "filter" and "mangle"; like parallel worlds with their own set of chains, each table having a distinct purpose (packet filtering, address/port translations, and other packet mangling/tagging). -- Daniel Roethlisberger http://daniel.roe.ch/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080508113524.GA7168>