freebsd stable - Oct 2011 - pf rdr rule question - corrected

Dear All,

I'd like to have the following ruleset, for pure-ftpd passive port 
range:

(pasv and past mistyping corrected)

---
ftp_pasv_start="X"
ftp_pasv_end="Y"

rdr on $netif inet proto tcp from any to $internalip port 
$ftp_pasv_start:$ftp_pasv_end -> $internalip

pass in quick on $netif proto tcp from any to $internalip port 
$ftp_pasv_start >< $ftp_pasv_end keep state flags S/SA
---

My problem is that I got " unknown port $ftp_pasv_end" errors when I 
try to load it with pfctl. Of course I checked the manual and there's 
not much about macros in the nat rule section. Anyone knows what did I 
do wrong or missed in the manual?

Thanks,
Andras
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to 
"freebsd-stable-unsubscribe@freebsd.org"

On 10/31/11 12:04 AM, G?t Andr?s wrote:
> Dear All,
> 
> I'd like to have the following ruleset, for pure-ftpd passive port
range:
> 
> (pasv and past mistyping corrected)
> 
> ---
> ftp_pasv_start="X"
> ftp_pasv_end="Y"
> 
> rdr on $netif inet proto tcp from any to $internalip port
> $ftp_pasv_start:$ftp_pasv_end -> $internalip
> 
> pass in quick on $netif proto tcp from any to $internalip port
> $ftp_pasv_start >< $ftp_pasv_end keep state flags S/SA
> 
pass in quick on $netif proto tcp from any to $internalip port
$ftp_pasv_start:$ftp_pasv_end


Both keep state and flags S/SA are default, you don't need to write them.