I have a Cisco 877 router and a Linode VPS running OpenBSD 5.9 with a GRE tunnel running in between, which works great and I can ping from either side. I have set up a static route in the Cisco router to route traffic to WhatsMyIP.org (so I can see if it's working) but, try as I might, I can't get OpenBSD's PF to apply NAT to traffic from the GRE tunnel. The configuration parses, the traffic routes, but I don't get any states being generated.
Is what I'm trying to achieve even possible? My topology and
/etc.pf.conf are below. (NOTE: Updated as per Bink's answer)
# $OpenBSD: pf.conf,v 1.54 2014/08/23 05:49:42 deraadt Exp $ # # See pf.conf(5) and /etc/examples/pf.conf set skip on lo block return # block stateless traffic ext_if = "em0" int_if = "gre0" int_net = "192.168.2.0/24" pass out on $ext_if from $int_net to any nat-to ($ext_if) pass # establish keep-state # By default, do not permit remote connections to X11 block return in on ! lo0 proto tcp to port 6000:6010 pass quick on gre proto gre no state
ifconfig output (IPs redacted):
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 32768 priority: 0 groups: lo inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 inet 127.0.0.1 netmask 0xff000000 em0: flags=18843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,MPSAFE> mtu 1500 lladdr f2:3c:91:0a:5b:a9 priority: 0 groups: egress media: Ethernet autoselect (1000baseT full-duplex) status: active inet E.F.G.H netmask 0xffffff00 broadcast E.F.G.255 enc0: flags=0<> priority: 0 groups: enc status: active pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33144 priority: 0 groups: pflog gre0: flags=9011<UP,POINTOPOINT,LINK0,MULTICAST> mtu 1476 priority: 0 groups: gre tunnel: inet A.B.C.D -> E.F.G.H inet 172.16.56.1 --> 172.16.56.2 netmask 0xffffff00