Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've got the basics of my pf firewall/NAT router setup working; traffic going out fine, DNS requests on port 53 mapped into an internal subnet and back out again successfully (no change in port number). But I'm stuck at a port forwarding from the internal gateway to a machine where I need to translate ports. Here's what I've got which doesn't seem to be working:

rdr on $ext_if inet proto tcp from any to port 24 -> port 22
pass in on $ext_if inet proto tcp from any to port 22

The network is public IP => this gateway at => machine needing ssh access at

port 22 on the public address is being used in a different subnetwork (a 10. network parallel to the network).

for reference the following IS working:

rdr on $ext_if proto udp from any to any port 53 ->
pass in on $ext_if inet proto udp from any to port 53

EDIT: So, adding "synproxy state" got it to the point where it was making a connection and trying to log in, then timing out (whereas it was failing pretty quick before). It could be just a matter of timeouts from here. I'll try again some time; for now I've just opened SSH on the router machine itself and can log in step by step (to router, then to machine).

share|improve this question
The rules ordering and the way you set your options could explain why it doesn't work. Could you edit your post post and put the complete pf rules file? – Benoit Sep 21 '09 at 13:13
try to get ftp passive to work, that's even more fun... – alexus Nov 19 '09 at 1:33

1 Answer 1

You have to use your gateway's external IP. Try this:

rdr on $ext_if inet proto tcp from any to ($ext_if:0) port 24 -> port 22

The parentheses will insert the IP address currently bound to that interface and keep it updated if it changes (because of DHCP, for example). The :0 indicates that it should only use the main IP bound to the interface, not aliased ones.

share|improve this answer
It looks like it's not the external but in this case I actually am in a relative sense -- this router sits down-stream from both an exernal (static IP, routable) router and another internal router. But thanks. – Devin Ceartas Sep 24 '09 at 14:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.