Добрый вечер.
Есть проблемы с настройкой pf и порт-форвардингом

Есть набор правил:

##Definition Section
        int_if="em0"
        ext_if="em1"
        ext_addr="xx.xx.xx.xx"
        int_network="192.168.1.0/24"
        icmp_types="echoreq"

##Internal Network Hosts
        locman="192.168.1.4"

##Common Block Policy
        scrub out all
        scrub in all
        set skip on lo0

##NAT Policy
        nat on $ext_if from $int_network to any -> ($ext_if)

##NAT Policy, locman-server publication
        rdr on $ext_if proto tcp from any to $ext_addr port rdp ->$locman port rdp

##Filtering Policy
#       block in all
#       block out all

##Internal Network
        #allow ftp,telnet,ssh,pop3
        #disallow www, smtp
        pass in on $int_if proto tcp from $int_if:network to any port {21,22,23,110} keep state
        pass in on $int_if proto icmp from $int_if:network keep state

##External Network
        pass in on $ext_if proto tcp from any to any port 22
        pass out on $ext_if proto tcp all modulate state flags S/SA
        pass out on $ext_if proto {udp, icmp} all keep state
        pass in on $ext_if proto tcp from any to any port rdp

результаты тестов:
gateway3# pfctl -sn
nat on em1 inet from 192.168.1.0/24 to any -> (em1) round-robin
rdr on em1 inet proto tcp from any to xx.xx.xx.xx port = rdp -> 192.168.1.4 port 3389

gateway3# pfctl -sr
scrub out all fragment reassemble
scrub in all fragment reassemble
pass in on em0 inet proto tcp from 192.168.1.0/24 to any port = ftp flags S/SA keep state
pass in on em0 inet proto tcp from 192.168.1.0/24 to any port = ssh flags S/SA keep state
pass in on em0 inet proto tcp from 192.168.1.0/24 to any port = telnet flags S/SA keep state
pass in on em0 inet proto tcp from 192.168.1.0/24 to any port = pop3 flags S/SA keep state
pass in on em0 inet proto icmp from 192.168.1.0/24 to any keep state
pass in on em1 proto tcp from any to any port = ssh flags S/SA keep state
pass out on em1 proto tcp all flags S/SA modulate state
pass out on em1 proto udp all keep state
pass out on em1 proto icmp all keep state
pass in on em1 proto tcp from any to any port = rdp flags S/SA keep state

Однако телнет на внешний интерфейс не проходит.
Есть какие-либо идеи. Порт 22 снаружи доступен, т.е фильтрация работает.

• pf, не получается настроить port-forwarding в pf,nix, 04:47 , 03-Мрт-12

  Вообще в правилах бред написан. Доки не читали точно.

>[оверквотинг удален]
>         ext_if="em1"
>         ext_addr="xx.xx.xx.xx"
>         int_network="192.168.1.0/24"
>         icmp_types="echoreq"
> ##Internal Network Hosts
>         locman="192.168.1.4"
> ##Common Block Policy
>         scrub out all
>         scrub in all
>         set skip on lo0

Рекомендую добавить set state-policy if-bound. Стейты будут создаваться на каждом интерфейсе, соответственно правила нужно писать для каждого интерфейса.
... А потом уже scrub ...

> ##NAT Policy
>         nat on $ext_if from
> $int_network to any -> ($ext_if)
> ##NAT Policy, locman-server publication
>         rdr on $ext_if proto
> tcp from any to $ext_addr port rdp ->$locman port rdp
> ##Filtering Policy
> #       block in all
> #       block out all

    Сначала ставите block, а далее открываете нужное. По интерфейсам. Лучше с опцией quick.

> ##Internal Network
>         #allow ftp,telnet,ssh,pop3
>         #disallow www, smtp
>         pass in on $int_if
> proto tcp from $int_if:network to any port {21,22,23,110} keep state
>         pass in on $int_if
> proto icmp from $int_if:network keep state

Добавьте pass out quick on $int_if inet proto tcp from any to $locman port rdp

> ##External Network
>         pass in on $ext_if
> proto tcp from any to any port 22
>         pass out on $ext_if
> proto tcp all modulate state flags S/SA
>         pass out on $ext_if
> proto {udp, icmp} all keep state
>         pass in on $ext_if
> proto tcp from any to any port rdp

Что бы открыть нужное, идущее из Инета к вашему внешнему фейсу достаточно этого

pass in quick on $ext_if inet proto tcp from any to $ext_if port {22, ....}
pass in quick on $ext_if inet proto tcp from any to $locman port rdp

pass out quick on $ext_if inet from any to any

>[оверквотинг удален]
> state
> pass in on em1 proto tcp from any to any port =
> ssh flags S/SA keep state
> pass out on em1 proto tcp all flags S/SA modulate state
> pass out on em1 proto udp all keep state
> pass out on em1 proto icmp all keep state
> pass in on em1 proto tcp from any to any port =
> rdp flags S/SA keep state
> Однако телнет на внешний интерфейс не проходит.
> Есть какие-либо идеи. Порт 22 снаружи доступен, т.е фильтрация работает.