Giving Two Seperate Networks Internet With PF

[EverydayDiesel]

Hello again.

I have two networks that I am trying to keep separate but allow internet access to each.

EXT="pppoe0"
INT1="re1"
INT2="re2"

INT_NET1= "{ 192.168.0.2, 192.168.0.3 }"
INT_NET2= "{ 10.0.0.2, 10.0.0.3 }"

block log all
set block-policy drop

match log on pppoe0 scrub (reassemble tcp max-mss 1440) 

nat on $EXT from $INT_NET1 -> ($EXT:0)
nat on $EXT from $INT_NET2 -> ($EXT:0)

pass out on $EXT inet from any to any
pass in on $INT inet from $INT_NET1 to any
pass in on $INT inet from $INT_NET2 to any

hostname.re1

inet 192.168.0.1 255.255.255.0

hostname.re2

inet 10.0.0.1 255.0.0.0

Traffic coming from INT_NET1 can get to the internet but traffic on INT_NET2 cannot.

This seems very simple and like it shoudl work, what am I doing wrong (and thanks in advance)

[J65nko]

I don't use PPPoE but to do NAT I have this in my pf.conf

# ---- external/egress interface
match out inet from ! egress to any  nat-to (egress)

If it still does not work please provide the output (on the pf box) of # ifconfig -A and # netstat -rn -f inet

[EverydayDiesel]

I went ahead and upgraded to 5.2, then i added the egress nat line you suggested and it now works. Thanks!

One more question though, I want to keep INT1="re1" and INT2="re2" from any form of communication with each other. Do I need to add any blocks for that or is it good as is?

[J65nko]

You have a default policy of block log all so as far as I can see you don't need any additional blocking rules.

You can verify this by running tcpdump on the pflog0 device and then for example do a ping from a a host on the INT1 net to one on the INT2 network.. The ping attempt should be blocked and show up in the tcpdump output.