pf: port forward with skip on lo

tux_tina

I'm trying to configure pf on freebsd 15.0 and am a bit stuck. I'd like to forward host port 80->bastille thin jail "caddy" port 8880 and host port 443->bastille thin jail "caddy" port 4430. This is my pf.conf: ## generated by bastille setup ext_if="vtnet0" set skip on lo set block-policy return scrub in on $ext_if all fragment reassemble table <jails> persist nat on $ext_if from <jails> to any -> ($ext_if:0) rdr-anchor "rdr/*" block in all pass...

Originally asked by Ruben Verweij on Stack Exchange (superuser) (CC BY-SA 4.0).

uphilltech

Great question — answering as the UphillTech team:

I finally solved it in three steps. Step 1 : This was solved with the help of PF firewall: How to disable all filtering on loopback interface EXCEPT specific port forwarding rules? but it initially didn't seem to work, because I skipped steps 2 and 3 below. My new /etc/pf.conf is: ## generated by bastille setup ext_if="vtnet0" set block-policy return scrub in on $ext_if all fragment reassemble table <jails> persist nat on $ext_if from <jails> to any -> ($ext_if:0) rdr-anchor "rdr/*" block in all pass quick on lo no state pass out quick keep state antispoof for $ext_if inet anchor "blocklistd/*" in on $ext_if anchor "f2b/*" in on $ext_if pass in proto tcp from any to any port ssh flags S/SA...

Full answer by Ruben Verweij: https://superuser.stackexchange.com/a/1933126 (CC BY-SA 4.0).

Need it done for your business? UphillTech.