Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am attempting to build a simple pf.conf which includes NAT allowing traffic out of the network from all systems on a select series of ports. In my basic configuration I have an internal server that hosts HTTP/HTTPS which will be accessible from the outside via the NATed IP. From the inside I would only like clients to leave the network on DNS/HTTP/HTTPS.

int_if="eth0"
ext_if="eth1"
localnet=$int_if:network

nat on $ext_if from $localnet to any -> ($ext_if)
comp1="172.16.0.1"
rdr on $ext_if proto tcp from any -> $comp1 port http
rdr on $ext_if proto tcp from any -> $comp1 port https

client_out_tcp = "{ http, https}"
client_out_udp = "{ 53 }"
pass inet proto tcp from $localnet to port $client_out_tcp
pass inet proto tcp from $localnet to port $client_out_udp

With this configuration my server is contacted on the proper ports as I designed however my clients can always leave the network no matter what.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

This is because you don't block outgoing traffic by default on your localnet.

Try using something along those lines:

block out from $localnet to any
pass inet proto tcp from $localnet to port $client_out_tcp
pass inet proto tcp from $localnet to port $client_out_udp
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.