View Single Post
  #3   (View Single Post)  
Old 4th April 2014
magrin magrin is offline
Real Name: Magnus
New User
 
Join Date: Apr 2014
Location: Göteborg, Sweden
Posts: 3
Default

Thanks, I'l try your suggestion to surround the interface with parenthesis. In the mean time, here is my pf.conf in its current state...

Code:
$ sudo cat /etc/pf.conf
# MACROS
ext_if="vr1"
int_if="vr0"

# 22  ssh
# 25  smtp
# 113 ident
# 443 https
# 587 smtp
# 993 imaps
tcp_services="{ 22, 25, 443, 587, 993 }"
icmp_types="echoreq"

# OPTIONS
set block-policy return
set loginterface $int_if
set skip on lo

# NORMALIZATION
scrub in

# NAT
nat on $ext_if from !$ext_if to any -> $ext_if
nat-anchor "ftp-proxy/*"

# REDIRECTION
rdr-anchor "ftp-proxy/*"
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
#rdr on $ext_if proto tcp from any to $ext_if port 8080 -> 127.0.0.1 port 22

# utorrent
rdr on $ext_if proto tcp from any to any port 52007 -> 192.168.1.35 port 52007
rdr on $ext_if proto udp from any to any port 52007 -> 192.168.1.35 port 52007
pass in quick on $ext_if proto tcp from any to any port 52007 flags S/SA keep state
pass in quick on $ext_if proto udp from any to any port 52007

# FILTER RULES
block in
pass out keep state

anchor "ftp-proxy/*"

antispoof quick for { lo $int_if }

pass in on $ext_if inet proto tcp from any to $ext_if \
  port $tcp_services flags S/SA keep state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in quick on $int_if
Reply With Quote