【请教】pf下的端口映射问题

ltokok

各位达人，最近遇到pf下的端口映射的棘手问题，请大家帮忙看看是为什么。
【环境简介】
A 客户端 124.93.240.206
B 服务器 内网IP 172.24.3.15   外网IP  219.216.100.78 静态路由 192.168.102.0/24 —> 172.24.3.1
C WEB服务器   192.168.102.16
设计目标 A访问 219.216.100.78:80      B服务器将80端口映射到内网的web服务器192.168.102.16上

【rc.conf】

1. test# more /etc/rc.conf
   
2. ifconfig_le1="inet 219.216.100.78  netmask 255.255.255.0"
   
3. ifconfig_le0="inet 172.24.3.15    netmask 255.255.255.0"
   
4. defaultrouter="219.216.100.1"
   
5. hostname="test.cn"
   
6. gateway_enable="YES"
   
7. sshd_enable="YES"
   
8. inetd_enable="YES"
   
9. pf_enable="YES"   
   
10. pf_rules="/etc/pf.conf"  
    
11. pf_flags=""            
    
12. pflog_enable="YES"      
    
13. pflog_logfile="/var/log/pflog"  
    
14. pflog_flags=""                 
    
15. ftpproxy_enable="YES"
    
16. /sbin/route add -net 172.23.0.0/16 172.24.3.1
    
17. /sbin/route add -net 192.168.102.0/24 172.24.3.1

复制代码

【pf.conf】

1. ext_if="le1"
   
2. int_if="le0"
   
3. webserver1="192.168.102.16"
   
4. lan_network="{192.168.102.0/24,172.23.0.0/16,172.24.3.0/24}"
   
5. nat on $ext_if from $lan_network to any -> ($ext_if)
   
6. rdr on $ext_if proto tcp from any to $ext_if port 80 -> $webserver1
   
7. pass out
   
8. pass in

复制代码

【sysctl】

1. test# sysctl -a | grep net.inet.ip.forwarding
   
2. net.inet.ip.forwarding: 1

复制代码

【pfctl -sa】

1. TRANSLATION RULES:
   
2. nat on le1 inet from 192.168.102.0/24 to any -> (le1) round-robin
   
3. nat on le1 inet from 172.23.0.0/16 to any -> (le1) round-robin
   
4. nat on le1 inet from 172.24.3.0/24 to any -> (le1) round-robin
   
5. rdr on le1 inet proto tcp from any to 219.216.100.78 port = http -> 192.168.102.16
   
6. 
   
7. FILTER RULES:
   
8. pass out all flags S/SA keep state
   
9. pass in all flags S/SA keep state
   
10. 
    
11. STATES:
    
12. all tcp 219.216.100.78:22 <- 124.93.240.206:53801       ESTABLISHED:ESTABLISHED
    
13. all tcp 192.168.102.16:80 <- 219.216.100.78:80 <- 124.93.240.206:57291       CLOSED:SYN_SENT
    
14. all tcp 124.93.240.206:57291 -> 192.168.102.16:80       SYN_SENT:CLOSED
    
15. all tcp 192.168.102.16:80 <- 219.216.100.78:80 <- 124.93.240.206:59522       CLOSED:SYN_SENT
    
16. all tcp 124.93.240.206:59522 -> 192.168.102.16:80       SYN_SENT:CLOSED

复制代码

结果就是端口转发无法实现。

ltokok

没人给哪怕一点点的建议吗?cu的freebsd版块这么凋零了？

lin_wang

http://www.openbsd.org/faq/pf/rdr.html#rdrnat