帮我看看pf.conf,为啥老错呢？附pf.conf，附图[已解决]

axlrose

改后提示什么错误？

liudew

原帖由 axlrose 于 2009-5-7 15:31 发表
改后提示什么错误？

报：
/etc/pf.conf  :11: syntax error

liudew

会不会有其它的问题呢？

lin_wang

1. 
   
2. >>       1 ext_if = "lnc1" #外部接口
   
3. >>       2 int_if = "lnc0"  #内部接口
   
4. >>       3 localnet = $int_if:network
   
5. >>       4 webserver = "{ 10.10.2.2 }"
   
6. >>       5 webport = "{ http, https }"
   
7. >>       6
   
8. >>       7 block in all
   
9. >>       8 block out all
   
10. >>       9
    
11. >>      10 rdr on $int_if proto tcp from $localnet to $int_if port $webport  -> $webserver port $webport
    
12. 
    
13. >>      11 pass all
    

复制代码

10 rdr on $int_if proto tcp from $localnet to $int_if port $webport  -> $webserver port $webport

你这条RDR规则让PF怎么处理呢?究竟让我重定向到哪个端口呢?

规则的顺序也错了
PF FAQ里已经说了

1. 
   
2. The pf.conf file has seven parts:
   
3. 
   
4. Macros:       User-defined variables that can hold IP addresses, interface names, etc.
   
5. Tables:        A structure used to hold lists of IP addresses.
   
6. Options:      Various options to control how PF works.
   
7. Scrub:         Reprocessing packets to normalize and defragment them.
   
8. Queueing:   Provides bandwidth control and packet prioritization.
   
9. Translation: Controls Network Address Translation and packet redirection.
   
10. Filter Rules: Allows the selective filtering or blocking of packets as they pass through any of the interfaces.
    
11. 
    
12. With the exception of macros and tables, each section should appear in this order in the configuration file, though not all sections have to exist for any particular application.
    

复制代码

With the exception of macros and tables, each section should appear in this order in the configuration file

[ 本帖最后由 lin_wang 于 2009-5-7 16:51 编辑 ]

liudew

clinet 端访问 10.10.1.1 80 通过PF重新定向到 10.10.2.2 80
图已经重新上传

lin_wang

我看不到图

liudew

原帖由 lin_wang 于 2009-5-7 17:47 发表

我看不到图

dylibin

试试这个
rdr on $int_if proto tcp from 10.10.1.0/24 to 10.10.1.1 port 80 -> 10.10.2.2 port 80

对了你有没有设置允许转发？先看看Nat正常不？

[ 本帖最后由 dylibin 于 2009-5-7 20:04 编辑 ]

qruntime

去掉最后一行，试试，看有没有错

dylibin

楼主结果如何？还有你有没有在rc.conf中设置允许PF等参数呀？