iptables rule in pf

[Oleksandr Samoylyk]

CZUCZY Gergely wrote:
> On Thu, 08 May 2008 11:05:45 +0300
> Oleksandr Samoylyk <oleksandr at samoylyk.sumy.ua> wrote:
> 
>> CZUCZY Gergely wrote:
>>> On Thu, 08 May 2008 01:04:54 +0300
>>> Oleksandr Samoylyk <oleksandr at samoylyk.sumy.ua> wrote:
>>>
>>>> Dear Community,
>>>>
>>>> I want to move some of our firewalls from Linux/iptables to FreeBSD/pf.
>>>>
>>>> After reading man pf.conf for a couple of minutes I couldn't find the
>>>> realization of such iptables rule in pf:
>>>>
>>>> iptables -t nat -A PREROUTING -i ethX -d ! my.smtp.server -p tcp --dport
>>>> 25 -j DROP
>>> block in on $interface proto tcp from any to ! my.smtp.server port 25
>>>
>>>> iptables -t nat -A PREROUTING -i ethX -p tcp --dport 2525 -j DNAT
>>>> --to-destination :25
>>> rdr on $interface proto tcp from any to port 2525 ->
>>> <the_destionation_you_have_omitted> port 25
>> I meant _any_ destination with 25 port.
>>
>> That iptables rule worked for any destination.
> You cannot rewrite a packet's destination address to _any_ destination.
> 
> It's like you cannot submit a package at the post office with the destination
> address "any". It's just meaningless.
> 

However it works with iptables. :)

What can I do in my situation in order to gain the same functionality by 
means of pf or other additional daemons?

-- 
  Oleksandr Samoylyk
  OVS-RIPE