NAT & port-mapping for OpenBSD PF
Wednesday, September 1, 2010 12:53:57 PM
1) If you have only one network interface, you need to set an alias with internal ip on it.
# vi /etc/hostname.dc0
inet 24.5.0.5 255.255.255.0 NONE media 100baseTX
inet alias 192.168.0.3 255.255.255.0
#ifconfig dc0 inet alias 192.168.0.3 netmask 255.255.255.0
$ ifconfig -A
dc0: flags=8863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST>
media: Ethernet manual
inet 24.5.0.5 netmask 0xffffff00 broadcast 192.168.0.255
inet 192.168.0.3 netmask 0xffffff00 broadcast 192.168.0.3
2) Setup NAT
# vi /etc/sysctl.conf
net.inet.ip.forwarding=1
net.inet6.ip6.forwarding=1
# sysctl net.inet.ip.forwarding=1
# sysctl net.inet6.ip6.forwarding=1 (if using IPv6)
# vi /etc/pf.conf
pass out on dc0 from 192.168.0.0/24 to any nat-to 24.5.0.5
# pfctl -f /etc/pf.conf
# pfctl -s state
dc0 TCP 192.168.0.35:2132 -> 24.5.0.5:53136 -> 65.42.33.245:22 TIME_WAIT:TIME_WAIT
dc0 UDP 192.168.0.35:2491 -> 24.5.0.5:60527 -> 24.2.68.33:53 MULTIPLE:SINGLE
3) Forward internet requests to NAT service
# vi /etc/pf.conf
pass in on dc0 proto tcp from any to any port 80 rdr-to 192.168.0.20
# pfctl -f /etc/pf.conf
REFERENCES:
http://www.openbsd.org/faq/pf/nat.html
http://www.openbsd.org/faq/faq6.html#Setup.aliases
http://www.openbsd.org/faq/pf/rdr.html
# vi /etc/hostname.dc0
inet 24.5.0.5 255.255.255.0 NONE media 100baseTX
inet alias 192.168.0.3 255.255.255.0
#ifconfig dc0 inet alias 192.168.0.3 netmask 255.255.255.0
$ ifconfig -A
dc0: flags=8863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST>
media: Ethernet manual
inet 24.5.0.5 netmask 0xffffff00 broadcast 192.168.0.255
inet 192.168.0.3 netmask 0xffffff00 broadcast 192.168.0.3
2) Setup NAT
# vi /etc/sysctl.conf
net.inet.ip.forwarding=1
net.inet6.ip6.forwarding=1
# sysctl net.inet.ip.forwarding=1
# sysctl net.inet6.ip6.forwarding=1 (if using IPv6)
# vi /etc/pf.conf
pass out on dc0 from 192.168.0.0/24 to any nat-to 24.5.0.5
# pfctl -f /etc/pf.conf
# pfctl -s state
dc0 TCP 192.168.0.35:2132 -> 24.5.0.5:53136 -> 65.42.33.245:22 TIME_WAIT:TIME_WAIT
dc0 UDP 192.168.0.35:2491 -> 24.5.0.5:60527 -> 24.2.68.33:53 MULTIPLE:SINGLE
3) Forward internet requests to NAT service
# vi /etc/pf.conf
pass in on dc0 proto tcp from any to any port 80 rdr-to 192.168.0.20
# pfctl -f /etc/pf.conf
REFERENCES:
http://www.openbsd.org/faq/pf/nat.html
http://www.openbsd.org/faq/faq6.html#Setup.aliases
http://www.openbsd.org/faq/pf/rdr.html






