0

I've got the basics of my pf firewall/NAT router setup working; traffic going out fine, DNS requests on port 53 mapped into an internal subnet and back out again successfully (no change in port number). But I'm stuck at a port forwarding from the internal gateway to a machine where I need to translate ports. Here's what I've got which doesn't seem to be working:

rdr on $ext_if inet proto tcp from any to 192.168.1.101 port 24 -> 192.168.0.105 port 22
pass in on $ext_if inet proto tcp from any to 192.168.0.105 port 22

The network is public IP => this gateway at 192.168.1.101 => machine needing ssh access at 192.168.0.105

port 22 on the public address is being used in a different subnetwork (a 10. network parallel to the 192.168.0.1/32 network).

for reference the following IS working:

rdr on $ext_if proto udp from any to any port 53 -> 192.168.0.105
pass in on $ext_if inet proto udp from any to 192.168.0.105 port 53

EDIT: So, adding "synproxy state" got it to the point where it was making a connection and trying to log in, then timing out (whereas it was failing pretty quick before). It could be just a matter of timeouts from here. I'll try again some time; for now I've just opened SSH on the router machine itself and can log in step by step (to router, then to machine).

cowgod
  • 3,500
  • 6
  • 28
  • 20
Devin Ceartas
  • 1,478
  • 9
  • 12
  • 1
    The rules ordering and the way you set your options could explain why it doesn't work. Could you edit your post post and put the complete pf rules file? – Benoit Sep 21 '09 at 13:13
  • try to get ftp passive to work, that's even more fun... – alexus Nov 19 '09 at 01:33

1 Answers1

1

You have to use your gateway's external IP. Try this:

rdr on $ext_if inet proto tcp from any to ($ext_if:0) port 24 -> 192.168.0.105 port 22

The parentheses will insert the IP address currently bound to that interface and keep it updated if it changes (because of DHCP, for example). The :0 indicates that it should only use the main IP bound to the interface, not aliased ones.

lukecyca
  • 2,205
  • 13
  • 20
  • It looks like it's not the external but in this case I actually am in a relative sense -- this router sits down-stream from both an exernal (static IP, routable) router and another internal router. But thanks. – Devin Ceartas Sep 24 '09 at 14:11