iptables rule in pf

[CZUCZY Gergely]

On Thu, 08 May 2008 11:05:45 +0300
Oleksandr Samoylyk <oleksandr at samoylyk.sumy.ua> wrote:

> CZUCZY Gergely wrote:
> > On Thu, 08 May 2008 01:04:54 +0300
> > Oleksandr Samoylyk <oleksandr at samoylyk.sumy.ua> wrote:
> > 
> >> Dear Community,
> >>
> >> I want to move some of our firewalls from Linux/iptables to FreeBSD/pf.
> >>
> >> After reading man pf.conf for a couple of minutes I couldn't find the
> >> realization of such iptables rule in pf:
> >>
> >> iptables -t nat -A PREROUTING -i ethX -d ! my.smtp.server -p tcp --dport
> >> 25 -j DROP
> > block in on $interface proto tcp from any to ! my.smtp.server port 25
> > 
> >> iptables -t nat -A PREROUTING -i ethX -p tcp --dport 2525 -j DNAT
> >> --to-destination :25
> > rdr on $interface proto tcp from any to port 2525 ->
> > <the_destionation_you_have_omitted> port 25
> 
> I meant _any_ destination with 25 port.
> 
> That iptables rule worked for any destination.
You cannot rewrite a packet's destination address to _any_ destination.

It's like you cannot submit a package at the post office with the destination
address "any". It's just meaningless.

> 
> >> How it can be rewriting in pf.conf?
> > be sure to read the openbsd faq:
> > http://www.openbsd.org/faq/pf
> > 
> > pf works quite differently then iptables, it has a different logic. you will
> > get used to it. just forget these "tables" which you've got used to with
> > iptables.
> > 
> 


-- 
Üdvölettel,

Czuczy Gergely
Harmless Digital Bt
mailto: gergely.czuczy at harmless.hu
Tel: +36-30-9702963
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20080508/5d720d5f/signature.pgp