I have a Cisco 877 router and a Linode VPS running OpenBSD 5.9 with a GRE tunnel running in between, which works great and I can ping from either side. I have set up a static route in the Cisco router to route traffic to WhatsMyIP.org (so I can see if it's working) but, try as I might, I can't get OpenBSD's PF to apply NAT to traffic from the GRE tunnel. The configuration parses, the traffic routes, but I don't get any states being generated.

Is what I'm trying to achieve even possible? My topology and /etc.pf.conf are below. (NOTE: Updated as per Bink's answer)

#       $OpenBSD: pf.conf,v 1.54 2014/08/23 05:49:42 deraadt Exp $
# See pf.conf(5) and /etc/examples/pf.conf

set skip on lo

block return    # block stateless traffic

ext_if = "em0"
int_if = "gre0"
int_net = ""

pass out on $ext_if from $int_net to any nat-to ($ext_if)
pass           # establish keep-state

# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010

pass quick on gre proto gre no state

Topology: GRE Tunnel Topology

ifconfig output (IPs redacted):

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 32768
        priority: 0
        groups: lo
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
        inet netmask 0xff000000
        lladdr f2:3c:91:0a:5b:a9
        priority: 0
        groups: egress
        media: Ethernet autoselect (1000baseT full-duplex)
        status: active
        inet E.F.G.H netmask 0xffffff00 broadcast E.F.G.255
enc0: flags=0<>
        priority: 0
        groups: enc
        status: active
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33144
        priority: 0
        groups: pflog
gre0: flags=9011<UP,POINTOPOINT,LINK0,MULTICAST> mtu 1476
        priority: 0
        groups: gre
        tunnel: inet A.B.C.D -> E.F.G.H
        inet --> netmask 0xffffff00

It’s not clear to me why you need a static route on your router, but, regardless, you have no rule in your pf.conf that relates to NAT. Try something like the following after your macros in pf.conf:

match out on egress from ! ( egress ) nat-to ( egress )


match out on $int_if from ! ( $int_if ) nat-to ( $int_if )

If those don’t work, post the output of ifconfig.

  • Sorry, code blindness, didn't even notice that I'd left the nat-to off the pass rule. I've fixed this and even though I'm now getting states, I'm still not getting any response. I'll update my original post with my ifconfig shortly. – Aaron Mason Jun 24 '16 at 1:01
  • Also, the static route is so that only certain traffic goes over the tunnel, not all traffic. – Aaron Mason Jun 24 '16 at 1:04

It seems that:

pass out on $ext_if from $int_net to any nat-to $ext_if

... doesn't work, it has to be this:

match out on $ext_if from $int_net to any nat-to $ext_if
pass      on $ext_if from $int_net to any

Also, it helps to make sure net.inet.ip.forwarding is set to 1.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.