2 added 18 characters in body; edited tags
source | link

I am running MacOS(really BSD), and I want to redirect certain traffic over an ssh tunnel using a a local forward. Seems easy enough, but I am repeatedly blocked by the ambiguous "/etc/pf.conf:29: syntax error" message at every turn. I must have gone through 30 iterations of the rule by now. Additionally, I have read the relevant OpenBSD packet filter information regarding syntax and redirection. Am at quiet the loss, and seek the help of someone smarter than myself about the BSD packet filter.

The goal is to take any traffic sourcing from my local machine destined to a machine on the internet to port 1234 and redirect the traffic to 127.0.0.1:1234. My specific os is OS X 10.10.2 Yosemite.

Here is the latest iteration of the rule which causes pfctl to return "syntax error"

pass out quick on en6 from any to en6 port 1234 rdr-to 127.0.0.1 port 1234pass out quick on en6 from any to en6 port 1234 rdr-to 127.0.0.1 port 1234

Based on the documentation and other random blogs on the Internet, this rule looks correct; pfctl however, disagrees.

The breakdown based on my understanding of the documentation is:

"pass"pass - the action to pass the traffic

"out"
out - the direction of traffic flow

"quick"
quick - if the packet matches this rule, then consider this the last rule in the chain

"on en6"
on en6 - the interface on which to apply the rule

"from any"
from any - the source of the packet (should always be my machine)

"to en6 port 1234"
to en6 port 1234 - to anything on the interface destined for port 1234

"rdr-to 127.0.0.1 port 1234"
rdr-to 127.0.0.1 port 1234 - redirect the packet to this interface

I am running MacOS(really BSD), and I want to redirect certain traffic over an ssh tunnel using a a local forward. Seems easy enough, but I am repeatedly blocked by the ambiguous "/etc/pf.conf:29: syntax error" message at every turn. I must have gone through 30 iterations of the rule by now. Additionally, I have read the relevant OpenBSD packet filter information regarding syntax and redirection. Am at quiet the loss, and seek the help of someone smarter than myself about the BSD packet filter.

The goal is to take any traffic sourcing from my local machine destined to a machine on the internet to port 1234 and redirect the traffic to 127.0.0.1:1234. My specific os is OS X 10.10.2 Yosemite.

Here is the latest iteration of the rule which causes pfctl to return "syntax error"

pass out quick on en6 from any to en6 port 1234 rdr-to 127.0.0.1 port 1234

Based on the documentation and other random blogs on the Internet, this rule looks correct; pfctl however, disagrees.

The breakdown based on my understanding of the documentation is:

"pass" - the action to pass the traffic

"out" - the direction of traffic flow

"quick" - if the packet matches this rule, then consider this the last rule in the chain

"on en6" - the interface on which to apply the rule

"from any" - the source of the packet (should always be my machine)

"to en6 port 1234" - to anything on the interface destined for port 1234

"rdr-to 127.0.0.1 port 1234" - redirect the packet to this interface

I am running MacOS(really BSD), and I want to redirect certain traffic over an ssh tunnel using a a local forward. Seems easy enough, but I am repeatedly blocked by the ambiguous "/etc/pf.conf:29: syntax error" message at every turn. I must have gone through 30 iterations of the rule by now. Additionally, I have read the relevant OpenBSD packet filter information regarding syntax and redirection. Am at quiet the loss, and seek the help of someone smarter than myself about the BSD packet filter.

The goal is to take any traffic sourcing from my local machine destined to a machine on the internet to port 1234 and redirect the traffic to 127.0.0.1:1234. My specific os is OS X 10.10.2 Yosemite.

Here is the latest iteration of the rule which causes pfctl to return "syntax error"

pass out quick on en6 from any to en6 port 1234 rdr-to 127.0.0.1 port 1234

Based on the documentation and other random blogs on the Internet, this rule looks correct; pfctl however, disagrees.

The breakdown based on my understanding of the documentation is:

pass - the action to pass the traffic
out - the direction of traffic flow
quick - if the packet matches this rule, then consider this the last rule in the chain
on en6 - the interface on which to apply the rule
from any - the source of the packet (should always be my machine)
to en6 port 1234 - to anything on the interface destined for port 1234
rdr-to 127.0.0.1 port 1234 - redirect the packet to this interface

1
source | link

macos - local port redirection using pfctl and syntax errors

I am running MacOS(really BSD), and I want to redirect certain traffic over an ssh tunnel using a a local forward. Seems easy enough, but I am repeatedly blocked by the ambiguous "/etc/pf.conf:29: syntax error" message at every turn. I must have gone through 30 iterations of the rule by now. Additionally, I have read the relevant OpenBSD packet filter information regarding syntax and redirection. Am at quiet the loss, and seek the help of someone smarter than myself about the BSD packet filter.

The goal is to take any traffic sourcing from my local machine destined to a machine on the internet to port 1234 and redirect the traffic to 127.0.0.1:1234. My specific os is OS X 10.10.2 Yosemite.

Here is the latest iteration of the rule which causes pfctl to return "syntax error"

pass out quick on en6 from any to en6 port 1234 rdr-to 127.0.0.1 port 1234

Based on the documentation and other random blogs on the Internet, this rule looks correct; pfctl however, disagrees.

The breakdown based on my understanding of the documentation is:

"pass" - the action to pass the traffic

"out" - the direction of traffic flow

"quick" - if the packet matches this rule, then consider this the last rule in the chain

"on en6" - the interface on which to apply the rule

"from any" - the source of the packet (should always be my machine)

"to en6 port 1234" - to anything on the interface destined for port 1234

"rdr-to 127.0.0.1 port 1234" - redirect the packet to this interface