Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am attempting to build a simple pf.conf which includes NAT allowing traffic out of the network from all systems on a select series of ports. In my basic configuration I have an internal server that hosts HTTP/HTTPS which will be accessible from the outside via the NATed IP. From the inside I would only like clients to leave the network on DNS/HTTP/HTTPS.


nat on $ext_if from $localnet to any -> ($ext_if)
rdr on $ext_if proto tcp from any -> $comp1 port http
rdr on $ext_if proto tcp from any -> $comp1 port https

client_out_tcp = "{ http, https}"
client_out_udp = "{ 53 }"
pass inet proto tcp from $localnet to port $client_out_tcp
pass inet proto tcp from $localnet to port $client_out_udp

With this configuration my server is contacted on the proper ports as I designed however my clients can always leave the network no matter what.

share|improve this question
up vote 1 down vote accepted

This is because you don't block outgoing traffic by default on your localnet.

Try using something along those lines:

block out from $localnet to any
pass inet proto tcp from $localnet to port $client_out_tcp
pass inet proto tcp from $localnet to port $client_out_udp
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.