pf, rdr, & anchors - broken or PEBKAC

[Nick Rogers]

On Tue, Sep 8, 2015 at 10:45 AM, Derek (freebsd lists) <
482254ac at razorfever.net> wrote:

> Hi!
>
> I'm trying to configure a basic layer-3 load balancer (10.2-RELEASE).  I
> initially started down this path with relayd from ports, as it seems to do
> what I need, very succinctly.
>
> What I've stumbled upon - I hope - is me not knowing how to cause rdr
> statements in anchors to be evaluated, although it appears that this
> functionality is currently broken.
>
> Take this contrived, most-trivial example (where 192.168.0.1 is external,
> and 10.2.2.251 is internal):
>
> /etc/pf.conf:
> rdr inet proto tcp from any to 192.168.0.1 port http -> 10.2.2.251
>
> sudo pfctl -Fa -f /etc/pf.conf
>
> *everything works as expected*
>
> Now, this time using anchors:
>
> sudo mv /etc/pf.conf /etc/pf.conf-anchor
>
> /etc/pf.conf:
> anchor testing
>

rdr rules must be in a "rdr-anchor". "anchor" is for filter rules.

load anchor testing from "/etc/pf.conf-anchor"
>
> sudo pfctl -Fa -f /etc/pf.conf
>
> gives TCP RSTs when connecting to port 80.  Additionally
>
> sudo pfctl -a testing -vvs nat:
> @0 rdr inet proto tcp from any to 192.168.0.1 port = http -> 10.2.2.251
>   [ Evaluations: 0         Packets: 0         Bytes: 0  States: 0     ]
>   [ Inserted: uid 0 pid 56764 State Creations: 0     ]
>
>
> So identical rulesets, one loaded as an anchor: never evaluated, the other
> loaded into the main ruleset directly: works fine.
>
> Is this broken, or am I missing something?
>
> Thanks!
> Derek
> _______________________________________________
> freebsd-pf at freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-pf
> To unsubscribe, send any mail to "freebsd-pf-unsubscribe at freebsd.org"
>