I would like to pass incoming packets on a specific port, which is used for NAT, even if these packets don't match a connection from the NAT table.
I use a machine with FreeBSD and pf as a router. A PBX on my local network must both reach a phone provider on the internet and be reachable through the internet with the same port (5060/udp SIP). More precisely: packets destined for the phone provider must have the source and destination port set to 5060/udp, or else they will be rejected by the phone provider (yes, the source port has to be 5060 also). Plus, all incoming packets on the external interface of my router on port 5060 have to be forwarded to the PBX machine (including incoming connections). Since the PBX only has a local IPv4, I use the following NAT rule to be able to send packets to the provider.
But with this rule in place, I can only receive packets that match a connection from the NAT table. If the provider wants to initiate a connection to my router, the packets get dropped by pf. Even if there are no block rules. I tried various redirection rules, for example:
... but without any success, which seems logical to me, because NAT rules "win" over redirect rules.
Maybe there is a way to tell pf, to accept these incoming connections.
Maybe there is a way to change the source address without a NAT rule. But I don't know how![Frown :( :(](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Here is a simplified version of my /etc/pf.conf
I use a machine with FreeBSD and pf as a router. A PBX on my local network must both reach a phone provider on the internet and be reachable through the internet with the same port (5060/udp SIP). More precisely: packets destined for the phone provider must have the source and destination port set to 5060/udp, or else they will be rejected by the phone provider (yes, the source port has to be 5060 also). Plus, all incoming packets on the external interface of my router on port 5060 have to be forwarded to the PBX machine (including incoming connections). Since the PBX only has a local IPv4, I use the following NAT rule to be able to send packets to the provider.
nat on $ext_if inet proto udp from $pbx port 5060 to ! $pbx port 5060 -> ($ext_if:0) static-port
But with this rule in place, I can only receive packets that match a connection from the NAT table. If the provider wants to initiate a connection to my router, the packets get dropped by pf. Even if there are no block rules. I tried various redirection rules, for example:
rdr on $ext_if inet proto udp from ! $pbx port 5060 to ($ext_if:0) port 5060 -> $pbx port 5060
... but without any success, which seems logical to me, because NAT rules "win" over redirect rules.
Maybe there is a way to tell pf, to accept these incoming connections.
Maybe there is a way to change the source address without a NAT rule. But I don't know how
Here is a simplified version of my /etc/pf.conf
Code:
ext_if = "ix0"
int_if = "ix1"
local_net = "192.168.0.0/24"
pbx = "192.168.0.2"
provider = "{ 92.197.176.16 92.197.176.17 92.197.176.18 92.197.176.19 92.197.177.16 92.197.177.17 92.197.177.18 92.197.177.19 92.197.182.16 92.197.182.17 92.197.182.18 92.197.182.19 }"
set block-policy drop
set skip on lo0
nat on $ext_if inet proto udp from $pbx port 5060 to ! $pbx port 5060 -> ($ext_if:0) static-port
nat on $ext_if inet from $local_net to any -> ($ext_if:0)
rdr on $ext_if inet proto udp from ! $pbx port 5060 to ($ext_if:0) port 5060 -> $pbx port 5060
block in log (all) all
pass in on $ext_if proto udp from any port 5060
pass in on $int_if proto udp from $pbx port 5060