I am running MacOS(really BSD), and I want to redirect certain traffic over an ssh tunnel using a a local forward. Seems easy enough, but I am repeatedly blocked by the ambiguous "/etc/pf.conf:29: syntax error" message at every turn. I must have gone through 30 iterations of the rule by now. Additionally, I have read the relevant OpenBSD packet filter information regarding syntax and redirection. Am at quiet the loss, and seek the help of someone smarter than myself about the BSD packet filter.

The goal is to take any traffic sourcing from my local machine destined to a machine on the internet to port 1234 and redirect the traffic to My specific os is OS X 10.10.2 Yosemite.

Here is the latest iteration of the rule which causes pfctl to return "syntax error"

pass out quick on en6 from any to en6 port 1234 rdr-to port 1234

Based on the documentation and other random blogs on the Internet, this rule looks correct; pfctl however, disagrees.

The breakdown based on my understanding of the documentation is:

pass - the action to pass the traffic
out - the direction of traffic flow
quick - if the packet matches this rule, then consider this the last rule in the chain
on en6 - the interface on which to apply the rule
from any - the source of the packet (should always be my machine)
to en6 port 1234 - to anything on the interface destined for port 1234
rdr-to port 1234 - redirect the packet to this interface

  • Please update your post and put complete your rules into your post – PersianGulf Mar 22 '15 at 2:18
  • I posted a complete rule did I not? I'm certain "pass out quick on en6 from any to en6 port 1234 rdr-to port 1234" is a complete rule. If not, perhaps that is the issue? – Robert Mar 22 '15 at 4:08
  • I update my anwer, you can test it . – PersianGulf Mar 22 '15 at 19:05

You can do it :

rdr pass quick on $ext_inf inet proto tcp from any to any port 1394 -> $target port 1394
| improve this answer | |
  • I played a little more with the setup the provided rule. 'rdr on $ext_inf inet proto tcp to port 1394 -> $target port 1394' The above rule ended up working. Apperently 'pass' and 'quick' are not okay in the rule. – Robert Mar 26 '15 at 2:13
  • It's good , you make me happy. – PersianGulf Mar 26 '15 at 2:14
  • By the way, OpenBSD syntax splited into 3 syntax : 1) 'keep state' becoming the default in OpenBSD 4.1 -- but everybody's forgotten about that one, mainly because FreeBSD and NetBSD back then adopted the change relatively quickly – PersianGulf Mar 26 '15 at 2:18
  • 2) the NAT rewrite and syntax change (nat-to, rdr-to etc) in 4.7 -- old rule sets will break, in almost all cases easily fixable, and the new syntax is lots more flexible anyway (and the reason The Book of PF needed a second edition) – PersianGulf Mar 26 '15 at 2:19
  • 3) the introduction of new queueing system in 5.5 - again an opportunity to make the rulse more readable and offering more flexibility, at the cost of at least some (mostly quite easy) conversion. (and the reason there is a third edition of that book) – PersianGulf Mar 26 '15 at 2:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.