I've a strange problem concerning NAT on an OpenBSD-Box with pf. I've cut down my pf.conf to the following lines:

extif = "pcn0"
intif = "pcn1"

block drop all

#Allow all incoming traffic from intif
pass in on $intif inet from $intif:network to any

#NAT everything which comes from intif and goes out on extif
match out on $extif inet from $intif:network to any nat-to $extif

pass out quick on $extif inet from $intif:network to any

This is not working somehow, the nat-to is not applied to the pass out rule. But if I use a rule like this:

match out on $extif inet from $intif:network to any nat-to $extif
pass out quick all

It is indeed working. And additionally if I do not work with the match-statement it works as well:

pass out quick on $extif inet from $intif:network to any nat-to $extif

This is really strange and not a solution because I want to restrict my rules further and apply the nat-to via match. Does anyone know why this is not working with match or where my typo is? (And yes IP-forwarding is enabled)


Old question but might as well answer...

The 'match' rule rewrites the address to $extif ....see the problem yet?

The following pass doesn't take this into account and ...packet on the floor ...well /dev/null or

I'd recommend adding a 'tag ALLOWED' onto the end of the 'match' rule and then change the pass rule:

pass out quick on $extif tagged ALLOWED

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.