I am trying to relay SSH connections from LAN hosts to hosts beyond VPN. Only one router host in the LAN has VPN connection to be reused by other hosts in LAN.

Below is pfctl configuration on the router.

extif = "utun0"
intif = "en1"
set skip on lo0
set ruleset-optimization none
set optimization normal
set timeout { tcp.established 360, tcp.closing 60 }
nat log on $extif from $intif:network to any -> ($extif)
pass in log on $extif from any to any
pass out log on $extif from any to any
pass in log on $intif from any to any
pass out log on $intif from any to any

utun0 interface (it has IP address above is interface facing VPN.

LAN host IP address is

Host beyond VPN where I am trying to SSH into has IP address

The problem is router's pfctl performs NAT for SYN packet only, but doesn't return SYN ACK answer of to LAN host.

In the meantime, router successfully NATs ICMP packets from LAN hosts, i.e. pings and I see in tcpdump that NAT is performed by the router.

Below is the result of sudo pfctl -ss during when I am to SSH host ( from LAN host ( ALL tcp -> -> ESTABLISHED:SYN_SENT

tcpdump also confirms that SYN ACK is not forwarded back to LAN host.

What should be changed in pfctl configuration file to make NAT work correctly for SSH connections to hosts beyond VPN?

Below is a screenshot of wireshark snapshot on utun0 interface:

Attached is screenshot of wireshark snapshot on utun0 interface

Below is the state in pfctl during SSH connection attempt:

$ sudo pfctl -s all | grep "\.34" | grep tcp
ALL tcp <-       CLOSED:SYN_SENT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.