ext_if = "{ wlan0 }" not_ext_if = "{ !wlan0 }" jail_nat_v4 = "{ 10.193.223.0/24 10.213.177.0/24 10.215.1.0/24 }" not_jail_nat_v4 = "{ any, !10.193.223.0/24 !10.213.177.0/24 !10.215.1.0/24 }" dns_redirect = "{ 10.193.223.1 10.213.177.1 10.215.1.1 }" dhcp = "{ bootpc, bootps }" allow = "{ wgf wgh drmario colo }" tcp_pass_in = "{ 22 }" udp_pass_in = "{ 53 51820 }" # Rules must be in order: options, normalization, queueing, translation, filtering # options set skip on lo # redirections nat pass on $ext_if inet from $jail_nat_v4 to $not_jail_nat_v4 -> (wlan0) rdr pass on $not_ext_if proto {tcp, udp} from any to 10.215.1.1 port 53 -> 1.1.1.1 port 53 # Redirect jaeger ports to virtual machine. # nat pass on lo inet from 127.0.0.0/24 to 127.0.0.0/24 port {6831 6832 16686 14268} -> (jail_nat) # rdr pass proto {tcp, udp} from jail_nat:network to 127.0.0.0/24 port {6831 6832 16686 14268} -> 10.215.1.201 # filtering block log all pass out on $ext_if pass in on jail_nat # Allow traffic from my machine to the jails/virtual machines pass out on jail_nat from jail_nat # We pass on the interfaces listed in allow rather than skipping on # them because changes to pass rules will update when running a # `service pf reload` but interfaces that we `skip` will not update (I # forget if its from adding, removing, or both. TODO: test to figure # it out). Also skipped interfaces are not subject to nat/rdr rules. pass quick on $allow pass on $ext_if proto icmp all pass on $ext_if proto icmp6 all pass in on $ext_if proto tcp to any port $tcp_pass_in pass in on $ext_if proto udp to any port $udp_pass_in