# NAT in PF



## douglasfim (Mar 16, 2011)

/etc/rc.conf

```
ifconfig_em0="DHCP"
ifconfig_em1="192.168.2.1"
ifconfig_em2="192.168.3.1"
ifconfig_em3="192.168.4.1"
# PF
pf_enable="YES"
pf_rules="/etc/pf.conf"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"

gateway_enable="YES"
```

/etc/sysctl.conf

```
net.inet.ip.forwarding=1
```

I am studying the PF but I have many doubts
and must put the network to function

I need to convert this rule in *Iptables* to *PF*

```
REDE=192.168.0.0/16
iptables -t nat -a POSTROUTING -s $REDE -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -D 192.168.1.102 -p tcp --dport 22 -j DNAT --to 192.168.2.10:22
```

This is the basic to operate the network


----------



## SirDice (Mar 16, 2011)

douglasfim said:
			
		

> /etc/sysctl.conf
> 
> ```
> net.inet.ip.forwarding=1
> ```


This already gets set by the "*gateway_enable*" in rc.conf. No need to explicitly set it.



> I need to convert this rule in *Iptables* to *PF*
> 
> ```
> REDE=192.168.0.0/16
> ...




```
ext_if=eth0
rede="{192.168.0.0/16}"

nat on $ext_if from $rede to any -> ($ext_if)
rdr on $ext_if inet proto tcp to port 22 -> 192.168.1.102 22
```


----------



## douglasfim (Mar 16, 2011)

`# more pf.conf`

```
# Regra padrao
pass in all

# define macros for each network interface
INET=em0
ILAN1=em1
ILAN2=em2
ILAN3=em3
IP_EXT="{ 192.168.1.1 }"
REDE="{ 192.168.0.0/16 }"
#tcp_services="{ 22, 443 }"

#scrub in all

#############
# NAT Rules #
#############
nat on $INET from $REDE to any -> ($INET)

#############
# Route Rules
#############
rdr on $INET inet proto tcp to port 22 -> 192.168.2.2 22
```

`# /etc/rc.d/pf start`

```
Enabling pf/etc/pf.conf:18: Rules must be in order: options, normalization, queueing, translation, filtering
/etc/pf.conf:23: syntax error
pfctl: Syntax error in config file: pf rules not loaded
.
```


----------



## DutchDaemon (Mar 17, 2011)

'*pass*' is filtering, '*nat/rdr*' is translation. They're in the wrong order in your ruleset.

[cmd=]man 5 pf.conf | less +/^STATEMENT[/cmd]


----------



## douglasfim (Mar 17, 2011)

`# more /etc/pf.conf`

```
####################
#      MACROS      #
####################
INET=em0
#ILAN1=em1
#ILAN2=em2
#ILAN3=em3
#IP_EXT="{ 192.168.1.1 }"
REDE="{ 192.168.0.0/16 }"
#tcp_services="{ 22, 443 }"

####################
#      TABLES      #
####################

####################
#     OPTIONS      #
####################

####################
#     TRAFFIC      #
####################

####################
#     QUEUEING     #
####################

####################
#   TRANSLATION    #
####################
nat on $INET from $REDE to any -> ($INET)
rdr on $INET inet proto tcp to port 22 -> 192.168.2.2 22

####################
# PACKET FILTERING #
####################
pass in all
```

`# /etc/rc.d/pf start`

```
Enabling pf/etc/pf.conf:32: syntax error
pfctl: Syntax error in config file: pf rules not loaded
.
```


----------



## douglasfim (Mar 17, 2011)

I edited


```
rdr on $ INET inet proto tcp to port 22 -> 192.168.2.2 22
```
to

```
rdr on $ INET inet proto tcp to port 22 -> 192.168.2.2 port 22
```

and everything worked, but I lost connection *SSH*
How do I release the *SSH* connection?


```
pass in all
```
 did not release all


----------



## DutchDaemon (Mar 17, 2011)

If 192.168.2.2 is behind a different interface, you'll probably need to allow 'pass out' on that one. Also make sure you have 
	
	



```
set skip on lo0
```
 somewhere. Without free traffic over loopback almost everything start acting strange.

Setting up pflog(4) and running tcpdump(1) on the interfaces and on pflog is the first step in troubleshooting.


----------



## douglasfim (Mar 21, 2011)

everything is already working

thanks


----------

