Building the Network You Need with OpenBSD's PF: BSDCan, Ottawa May 6th, 2009
Prev |  | Next

# Simple gateway with NAT (cont'd.)

or perhaps

    client_out = "{ ftp-data, ftp, ssh, domain, pop3, auth, nntp, http, \
                 https, 446, cvspserver, 2628, 5999, 8000, 8080 }"
    udp_services = "{ domain, ntp }"

    pass quick inet proto { tcp, udp } to any port $udp_services keep state

    pass inet proto tcp from $int_if:network to any port $client_out \
                    flags S/SA keep state

    pass in inet proto tcp from any to any port ssh

Rule evaluations is top to bottom, last matching rule wins.

The quick keyword exits rule evaluation when current rule matches (quick rule always wins)