NPF woes with port forwarding

Thiesi

Hi guys,

I've been using ipfilter for the past two decades or so, but given its state I'm trying to switch to NPF on a server. The system in question has several network cards, each for a dedicated service bound to just one particular card. They are all directly connected to the Internet.

However, I’m currently struggling with getting a simple port forwarding working. All I want to do is forward all inbound traffic to port 22 on my wm3 interface to port 2222 on the same interface (i. e. the same IP address). One would think it should be straight forward, but a simple

map wm3 dynamic $wm3_ip 2222 <- $wm3_ip port 22

did not exactly yield the desired results (i. e. it did nothing). Any idea what I’m doing wrong?

Jay

Thiesi
Below lines are example fragments of bi-directional NAT and port 2222 forwarding to a local IP address, port 22:
map $ext_alt_if dynamic $local_host_1 <-> $ext_alt_if map $ext_if dynamic $local_host_2 port 22 <- $ext_if port 2222

You will need to add this on /etc/npf.conf

Jay

Did it work for you ?

Thiesi

Jay Nope, unfortunately, it didn't. Apparently, it doesn't make a difference whether I use the interface name directly in the rule or a variable which gets defined like this:

$wm3         = { wm3 }
$wm3_ip      = { inet4($wm3) }

FWIW, this is the resulting rule:
map wm7 dynamic 51.77.xxx.yyy port 2222 <- any pass family inet4 proto { tcp, udp } to 51.77.xxx.yyy port 22 # id="1"

Doesn't that look perfectly fine?
Don't mind the wm7 btw. - I switched around network interfaces in the meantime.