[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

PF, Interface-groups and nat



Hi
I'm trying to set up a small home-network with both wired and wireless
access, so I've put the following NICs in a box:
ath0: internal wireless 192.168.1.1
rl0: internal wired 192.168.0.1
rl1: external wired DHCP

I've used the following pf.conf (a slight adaption from the example in
the pf-FAQ):
------------------------------------------------
# macros
tcp_services = "{ 22, 113 }"
icmp_types = "echoreq"

# options
set block-policy return
set loginterface rl1

# scrub
scrub in all

# nat/rdr
nat on rl1 from ath0:network to any -> (rl1)
nat on rl1 from rl0:network to any -> (rl1)

# filter rules
block all

pass quick on lo0 all

pass in on rl1 inet proto tcp from any to (rl1) \
       port $tcp_services flags S/SA keep state

pass in inet proto icmp all icmp-type $icmp_types keep state

pass in on ath0 from ath0:network to any keep state
pass out on ath0 from any to ath0:network keep state
pass in on rl0 from rl0:network to any keep state
pass out on rl0 from any to rl0:network keep state

pass out on rl1 proto tcp all modulate state flags S/SA
pass out on rl1 proto { udp, icmp } all keep state
------------------------------------------------

Then I tried to use interface-groups (cool feature, and it seems like
it might reduce the pf.conf-file and make it easier to maintain) and put rl1 in group "if_ext" and the other two NICs in "if_int" and tried
to adapt pf.conf accordingly and got this:
------------------------------------------------
# macros
tcp_services = "{ 22, 113 }"
icmp_types = "echoreq"


# options
set block-policy return
set loginterface if_ext

# scrub
scrub in all

# nat/rdr
nat on if_ext from (if_int:network) to any -> (if_ext)

# filter rules
block all

pass quick on lo0 all

pass in on if_ext inet proto tcp from any to (if_ext) \
       port $tcp_services flags S/SA keep state

pass in inet proto icmp all icmp-type $icmp_types keep state

pass in on if_int from (if_int:network) to any keep state
pass out on if_int from any to (if_int:network) keep state

pass out on if_ext proto tcp all modulate state flags S/SA
pass out on if_ext proto { udp, icmp } all keep state
------------------------------------------------

All seems fine, running pfctl -n on it produces nothing, but when
trying to load the rules I get DIOSETSTATUSIF, and no rules are
loaded. What am I doing wrong?

--
Erik Wikstrvm



Visit your host, monkey.org