openbsd做NAT死活不通，救命啊

ioerr

换装openBSD4.8中：
rc.conf
   pf=YES

sysctl.conf
   net.inet.ip.forwarding=1

pf规则如下：

ext_if="fxp0"  #外网
int_if ="fxp1"  #内网
dmz_if="rl0"    #dmz

#set skip on lo

pass out on $ext_if from 192.168.1.0/24 to any nat-to $ext_if

block all
pass all


死活不通啊。愁死我了 。
原来配置过4.2和4.5的，以为很容易的事呢，结果被搞定，help，almost crazy！


3.17日补充：
----------
现在是调通了，但是谁能解释下为什么蓝色的规则不通么？

congli

现在PF的规则搞得有点不适应!

congli

pass out on $ext_if inet from 192.168.1.0/24 to any nat-to $ext_if

congli

前两天在4.8上测试的

1. 
   
2. ext_if = "em1"
   
3. int_if = "em0"
   
4. lo_if  = "lo0"
   
5. 
   
6. pass quick on $lo_if all
   
7. pass out on $ext_if inet from $int_if:network to any nat-to $ext_if
   
8. pass quick on $int_if all keep state
   
9. 
   

复制代码

ioerr

我的  ：pass out on $ext_if from 192.168.1.0/24 to any nat-to $ext_if
版主的：pass out on $ext_if inet from 192.168.1.0/24 to any nat-to $ext_if

就查一個inet？

下午開會，有時間我試試去

congli

应该是block all, 如果是,还得加个quick.
pass out quick on $ext_if inet from 192.168.1.0/24 to any nat-to $ext_if

congli

按FAQ上,又可以使用match及pass两个.

1. 
   
2. ext_if = "em1"
   
3. int_if = "em0"
   
4. lo_if  = "lo0"
   
5. 
   
6. pass quick on $lo_if all
   
7. pass quick on $int_if all keep state
   
8. 
   
9. match out on $ext_if inet from $int_if:network to any nat-to $ext_if
   
10. pass out on $ext_if from $ext_if to any
    

复制代码

myuebbs

这个您加 了没
# nat/rdr
#nat on $ext_if from $stu_if:network to any -> ($ext_if)
nat on $ext_if from $web_if:network to any -> ($ext_if)
nat on $ext_if from $oth_if:network to any -> ($ext_if)
rdr on $ext_if proto tcp from any to any port {80,21,20} -> $web_host

呵呵，致命的一处，貌似

ioerr

回复 8# myuebbs


    我现在还没通，考虑不了www什么的服务。

ioerr

回复 6# congli


    初步找到问题了，应该是
pass out quick on $ext_if from $int_if:network to any nat-to $ext_if

加上这个quick就ok了，艹，就这个，差点让我吐血。

我再好好试试，查查手册，然后来个总结，就这么点，真是郁闷，幸好版主帮忙，谢谢了！