pf rules sanity check

[David Mehler]

Hello,

Can someone take a look at these rules and let me know where I'm going wrong?

I'm running a 10.3 system that was working great, but now I've added
some jails to it and am noticing two behaviors.

The first is that whenever I bring up a new jail and it gets an ip
address I have to do a pfctl -f pf.conf in order to get that new host
out to the internet, otherwise it just sits there.

Secondly and more urgent is that while traffic outbound from both the
host and the jails is passing fine, (the jail traffic is natted), the
reverse is not true. Traffic can come in from the host, but if I try
to get traffic through to the jail just hangs finally timing out.

Thanks.
Dave.

pf.conf:
ext_if="vtnet0"
int_if = "lo1"
jailnet = $int_if:network
icmp_types="echoreq"
icmp6_types="{ 2, 128 }" # packet too big, echo request (ping6)
# Neighbor Discovery Protocol (NDP) (types 133-137):
#   Router Solicitation (RS), Router Advertisement (RA)
#   Neighbor Solicitation (NS), Neighbor Advertisement (NA)
#   Route Redirection
icmp6_types_ext_if="{ 128, 133, 134, 135, 136, 137 }"
synstate ="flags S/SA synproxy state"
tcpstate ="flags S/SA modulate state"
udpstate ="keep state"

webmail="192.168.52.22"

tcp_services="{bootpc, bootps, ftp-data, ftp, ssh, domain, smtp, http,
https, imap, imaps, 3690, 7, 2703, 587, 8080}"
udp_services="{bootpc, bootps, domain, ntp, 3690, 6277, 24441}"

set block-policy return
set skip on lo0

# Normalization
# normalize all incoming traffic. Set ttl 254: limits mapping of hosts behind
# firewall. Set random-id to help same.
# Set mss to ATM network frame size for easy splitting upstream.
scrub on $ext_if all random-id min-ttl 254 max-mss 1452 reassemble tcp
fragment reassemble

# NAT
nat on $ext_if inet from $jailnet to any -> ($ext_if)

# Redirect any packets requesting port 8080 or 4430 to jailed webserver
rdr on $ext_if inet proto tcp from any to $ext_if port 8080 ->
$webmail port 8080
#rdr pass on $ext_if inet proto tcp to port 8080 -> $webmail port http
#rdr pass on $ext_if inet proto tcp to port 4430 -> $webmail port https

table <bruteforce> persist file "/etc/pf/bruteforce"
table <fail2ban> persist file "/etc/pf/fail2ban"

pass quick on lo0 all

# Block by default
block all

# Explicitly block anything in the bruteforce table
block in quick from <bruteforce>

# Explicitly block anything in the fail2ban table
block in quick from <fail2ban>

# Pass out only the desired ports from host and jails
pass quick proto tcp from {self} to port $tcp_services keep state
(max-src-conn 100, max-src-conn-rate 15/5, overload <bruteforce> flush
global)
pass quick proto tcp from $jailnet to port $tcp_services keep state
(max-src-conn 100, max-src-conn-rate 15/5, overload <bruteforce> flush
global)
pass quick proto {tcp, udp} from {self} to port $udp_services keep state
pass quick proto {tcp, udp} from $jailnet to port $udp_services keep state

# allow ping
pass inet proto icmp icmp-type $icmp_types keep state

# Traceroute
# allow out the default range for traceroute(8):
  # ”base+nhops*nqueries-1” (33434+64*3-1)
pass inet proto udp to port 33433:33626 # For IPv4

# allow https traffic out from the jails
pass out proto tcp from $jailnet port https to any keep state

 # Allow ssh connections in from the internet
pass in proto tcp from any to $ext_if port ssh keep state

# Pass in http traffic from the internet
pass in inet proto tcp to $ext_if port 80 keep state

# Pass in https traffic from the internet
pass in inet proto tcp to $ext_if port 443 keep state

# Pass in smtp traffic from the internet
pass in inet proto tcp to $ext_if port 25 keep state

# Pass in submission traffic from the internet
pass in inet proto tcp to $ext_if port 587 keep state

# Pass in imaps traffic from the internet
pass in inet proto tcp to $ext_if port 993 keep state

# Pass in port 8080 to the jailed web server
pass in inet proto tcp to $webmail port 80 keep state

# IPv6
pass quick on $ext_if inet6 proto ipv6-icmp icmp6-type $icmp6_types keep state
pass quick on $ext_if inet6 proto ipv6-icmp from any to { ($ext_if ),
ff02::/16 } icmp6-type $icmp6_types_ext_if keep state