Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using pf on FreeBSD 9. sshd is up and listening on loopback only (

Trying to use redirect rule to allow network hosts to connect via ssh.

set block-policy drop
set skip on lo0
scrub in

no rdr on lo0 all
rdr on fxp0 inet proto tcp from any to (fxp0) port = ssh ->

block drop in log quick on ! lo inet from to any
block drop log on fxp0 all
pass in quick on fxp0 inet proto tcp from any to port ssh
pass out quick on fxp0 all keep state

This does not work for some reason and I see no related messages in pflog.

Tried also with rdr pass with same result.

I see this status from pfctl -ss:

all tcp ( <-   CLOSED:SYN_SENT

When I turn logging for rdr, I see this:

rdr in on fxp0: > Flags [S], seq 1927917349, win 65535, options [mss 1460,nop,wscale 3,sackOK,TS[|tcp]>

What is wrong with my setup?

How to get more log output?

share|improve this question

Have you checked your sshd listening addresses?

$ netstat -a | grep ssh
tcp4       0      0 *.ssh                  *.*                    LISTEN
tcp6       0      0 *.ssh                  *.*                    LISTEN

The first * means that sshd is listening on every local addresses on the machine including


         Specifies the local addresses sshd(8) should listen on.  The fol-
         lowing forms may be used:

               ListenAddress host|IPv4_addr|IPv6_addr
               ListenAddress host|IPv4_addr:port
               ListenAddress [host|IPv6_addr]:port

         If port is not specified, sshd will listen on the address and all
         prior Port options specified.  The default is to listen on all
         local addresses.  Multiple ListenAddress options are permitted.
         Additionally, any Port options must precede this option for non-
         port qualified addresses.

If sshd is not listening on address, it is shown as CLOSED:SYN_SENT in pfctl -ss output.

netstat output after making sshd listen on only.

$ netstat -a | grep ssh
tcp4       0      0     *.*                    LISTEN

While trying to ssh to this machine, pfctl -ss output is like below.

$ pfctl -ss
all tcp ( <-       CLOSED:SYN_SENT

ssh connection is redirected to by rdr rule - SYN packet is sent to (SYN_SENT)

However, is not open, it is shown as CLOSED.

share|improve this answer
or try sockstat to display listening sockets; ~]sockstat -4l | grep ssh – Daywalker Feb 11 '15 at 11:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.