# Pf -Jail and port forwaring



## fred974 (Sep 23, 2013)

Hello all,

I have a web server setup inside a FreeBSD jail. On the host, I have PF firewall that redirects HTTP and HTTPS to my jail IP. My question is: on the router, do I set the port redirection to go to the host or the web server IP?

Thank you
Fred


----------



## SirDice (Sep 23, 2013)

What IP addresses did you use for the host and the jail?


----------



## fred974 (Sep 23, 2013)

Host - 192.168.0.85
Jail - 192.168.0.185

pf.conf

```
ext_if="alc0"
#int_if = "lo1"
sshd_port="22"
webjail="192.168.0.175"
table <blockgeoip> persist file "/etc/blocked.txt"
scrub in

#Redirect web traffic to the jail.
rdr on $ext_if proto tcp from any to $ext_if port http -> $webjail port http
rdr on $ext_if proto tcp from any to $ext_if port https -> $webjail port https
```


----------



## SirDice (Sep 23, 2013)

Your pf.conf actually does absolutely nothing as you cannot forward a port on the same interface. 

So, remove the redirects and set your router to forward directly to the jail's IP address.


----------



## fred974 (Sep 23, 2013)

I was following this tutorial:

I did 

`ifconfig lo1 create`
`ifconfig lo1 inet 10.0.0.1 netmask 255.255.255.0`

/etc/rc.conf


```
cloned_interfaces="lo1"
ifconfig_lo1="inet 192.168.0.185 netmask 255.255.255.0"
```


So is this info incorrect?


----------



## SirDice (Sep 23, 2013)

The info is correct but you now have two interfaces on the same subnet (lo1 and alc0, both are in 192.168.0.0/24). That's certainly not going to work.

I wouldn't bother with it actually. Just bind your jail to alc0 with the IP address you chose. No need for NAT or any other complicated set up. Then forward port 80 on your router to the jail's IP address directly.


----------



## fred974 (Sep 23, 2013)

Ha .... I see.
So how do I get PF to protect the host and jail?


----------



## SirDice (Sep 23, 2013)

Just treat the jail's IP address as just another IP address on the host.


----------



## fred974 (Sep 23, 2013)

@SirDice,

You rescued me once again

Thank you for your support

Fred


----------

