# Problem with PF ruleset



## DXT (Jul 31, 2014)

When i try to
	
	



```
pftcl -f /etc/pf.conf
```
 it returns the follow:


With this ruleset:

```
ext_if = "ep0" # macro for external interface - use tun0 for PPPoE
int_if = "ep1" # macro for internal interface
localnet = $int_if:network
# ext_if IP address could be dynamic, hence ($ext_if)
match out on $ext_if from $localnet nat-to ($ext_if)
block all
pass inet proto tcp from { self, $localnet }
```
says Syntax incorrect

And with this other

```
ext_if = "ep0" # macro for external interface - use tun0 for PPPoE
int_if = "ep1" # macro for internal interface
localnet = $int_if:network
# ext_if IP address could be dynamic, hence ($ext_if)
nat on $ext_if from $localnet to any -> ($ext_if)
block all
pass inet proto tcp from { self, $localnet }
```
Rules must be in order

if someone can help me with this


----------



## aupanner (Jul 31, 2014)

You need to use the latter NAT form and not the former.  *nat-to* is the newer OpenBSD syntax.

Your latter rules look ok.  Maybe the problem is that you're not clearing the old ruleset?  Try adding *-F rules* to your pfctl() command.


----------

