Anyone have a working pf redirect rule?

[epitaxial]

I've been trying for hours now to redirect a port on my external wan ip to an internal machine. I've tried various combinations of

rdr on $ext_if proto udp from any to $ext_if port 32400 -> 192.168.1.32 port 32400

and

rdr on $ext_if proto tcp from any to any port 32400 -> 192.168.1.32

But nothing seems to work!

Here is the whole pf.conf

# Set some variables for use later
ext_if="em0"
int_if="ix0"
icmp_types="echoreq"

# Skip all loopback traffic
set skip on lo

# Scrub all traffic
scrub in

# Perform NAT on external interface
#rdr on $ext_if proto udp from any to $ext_if port 32400 -> 192.168.1.32 port 32400
nat on $ext_if from $int_if:network -> ($ext_if:0)
rdr on $ext_if proto tcp from any to any port 32400 -> 192.168.1.32



# Define default behavior
block in
pass out keep state

# Allow inbound traffic on internal interface
pass quick on $int_if

# Protect against spoofing
antispoof quick for { lo $int_if }

# Allow other traffic
pass in on $ext_if proto tcp to ($ext_if) port 32400 flags S/SA keep state

What am I doing wrong?

[vns3]

First of all I am not an expert with fw's lol.

Looking at your rdr rule and comparing it with examples in The Book of PF, the rdr line itself seems right.

I believe rdr requires another rule passing the traffic as well. Which is what it looks like you are doing here.

pass in on $ext_if proto tcp to ($ext_if) port 32400 flags S/SA keep state

If it were me I would open this rule up and see what happens. I am not sure why you need the "to" part of the statement. And it seems to me that might be blocking any traffic not having a destination of em0.

Are em0 and 192.168.1.32 the same device?

[epitaxial]

Thanks for the reply. em0 is my wan ip address and 192.168.1.32 is a separate box on my internal network.