Hi folks, I have a firewall basically masking a bunch of IPs behind it, and a bunch of rules that do RDRs from an IP on interface1 to an IP on interface 2. These are 1-to-1 IP mappings. The firewall has a bunch of CARP IPs defined on the external interface that map back to real IPs (servers) behind it.
I could have sworn I once saw a way to do this with tables or macros on each end of the RDR but I've been googling for some time now and coming up with nothing. And even checked my PDF copy of the book of PF and search on every instance of "rdr" and found nothing. Basically a bunch of these : pass in quick log on $extIf inet proto tcp from any to (external IP #1) port (some port) rdr-to (internal IP #1) pass in quick log on $extIf inet proto tcp from any to (external IP #2) port (some port) rdr-to (internal IP #2) and so on. I guess I could just try it on a DEV box but I'd like to know first. Either define a macro or table for both the internal and external IPs and let PF forward from the first one listed on the left, to the first one on the right, and 2nd to 2nd and so on. internalIPS = { 1 2 3 } externalIPS = { 4 5 6 } pass in quick log on $extIf inet proto tcp from any to (externalIPs) port (some port) rdr-to (internalIPs) Maybe I'm just hallucinating :-) -- "Don't eat anything you've ever seen advertised on TV" - Michael Pollan, author of "In Defense of Food"