Ouch, let's try that again with the line wrap set to a more reasonable value. Sorry!
Here is my pf.conf file. Some things are working -- like access to the internet from within the network. Other things, like external access to the web sites, and incoming email, are not working. Outgoing email and pings are working. I'm thinking the problems are most likely in the NAT section, labeled as problematic below. # note: real external IP address has been replaced with 999.999.999 # real internal IP addresses have not been changed. eif="dc0" # external interface, routes 999.999.999.226-230 iif="dc1" # internal interface, 192.168.0.230 external_net="999.999.999.224" # external network (/29) internal_net="192.168.0.224" # internal network (/29) eipc="999.999.999.226" # foo.com (not its real name) web site, external address eipa="999.999.999.227" # bar.com (not its real name) web site, external address eipf="999.999.999.229" # firewall, external address iipc="192.168.0.226" # foo.com web site, internal address iipa="192.168.0.227" # bar.com web site, internal address iipf="192.168.0.229" # firewall, internal address fssaks="flags S/SA keep state" unrouteable="{ 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, \ 192.168.0.0/16, 255.255.255.255/32 }" # normalize: reassemble fragments and resolve or reduce traffic ambiguities scrub out all scrub in all ############# THIS SECTION IS TOTALLY BROKEN -- CLUES WELCOME! ############# # nat: packets going out through ext0 with source address 10.0.0.0/8 will get # translated as coming from 192.168.1.1. a state is created for such packets, # and incoming packets will be redirected to the internal address. # nat on ext0 from 10.0.0.0/8 to any -> 192.168.1.1 # make ftp clients work ??? very iffy. nat on $eif from $internal_net/29 to any -> $eipf port ftp # make everything else work # what is this? is 226/29 right, or should it be 224/29? or would 0/24 work? nat on $eif from $internal_net/29 to any -> $eipf # this gives "expands to multile ips of same family" error #binat on $eif from $iipc to $eipc -> $eif #binat on $eif from $iipa to $eipa -> $eif # the author likes this #binat on $eif from $iipc to any -> $eipc #binat on $eif from $iipa to any -> $eipa #the man page likes this #binat on $eif from $iipa to any -> ($iif) ############# END OF BROKEN SECTION -- I HOPE! ############# # foo.com web, mail, ssh rdr on $iif proto tcp from any to $eipc/32 port 80 -> $iipc port 8080 rdr on $iif proto tcp from any to $eipc/32 port 25 -> $iipc port 25 rdr on $iif proto tcp from any to $eipc/32 port 22 -> $iipc port 22 # bar.com web, mail, ssh rdr on $iif proto tcp from any to $eipa/32 port 80 -> $iipa port 8090 rdr on $iif proto tcp from any to $eipa/32 port 25 -> $iipa port 25 rdr on $iif proto tcp from any to $eipa/32 port 22 -> $iipa port 22 # filter rules antispoof for lo0 antispoof for dc0 inet antispoof for dc1 inet block out log all block in log all block return-rst in log inet proto tcp all block return-rst out log inet proto tcp all block return-icmp in log inet proto udp all block return-icmp out log inet proto udp all # block packets from or to unrouteable addresses block in log quick on $eif from $unrouteable to any block out log quick on $eif from any to $unrouteable # by default, block all incoming packets, except those explicity # allowed by further rules. block in log on $eif all # for www connections from the outside pass in log quick on $eif proto tcp from any to $iipc port 8080 $fssaks pass in log quick on $eif proto tcp from any to $iipa port 8090 $fssaks # for mail connections from the outside pass in quick on $eif inet proto tcp from any to $eipc port 25 $fssaks pass in quick on $eif inet proto tcp from any to $eipa port 25 $fssaks # for ident connections from the outside pass in quick on $eif proto tcp from any to $eipc port 113 $fssaks pass in quick on $eif proto tcp from any to $eipa port 113 $fssaks # ident on firewall pass in quick on $eif proto tcp from any to $eipf port 113 $fssaks # pass ssh, plus locally originating outgoing traffic pass in on $eif inet proto tcp from any to $eif port 22 $fssaks # deal with outgoing traffic block out on $eif all pass in quick on { lo0, $iif } all pass out quick on { lo0, $iif } all pass out on $eif inet proto tcp all $fssaks pass out on $eif inet proto { udp, icmp } all keep state # block attempts to 1) access our network; 2) broadcast; 3) fingerprint block in log quick on $eif from any to { 999.999.999.0/32, $external_net/32 } block in log quick on $eif from any to { 999.999.999.231/32, 999.999.999.255/32 } block in log quick on $eif inet proto tcp all flags FUP/FUP __________________________________________________ Do you Yahoo!? Yahoo! Web Hosting - Let the expert host your site http://webhosting.yahoo.com