I’m trying to configure pf on freebsd 15.0 and am a bit stuck. I’d like to forward host port 80->bastille thin jail “caddy” port 8880 and host port 443->bastille thin jail “caddy” port 4430. This is my pf.conf:
## generated by bastille setup
ext_if="vtnet0"
set skip on lo
set block-policy return
scrub in on $ext_if all fragment reassemble
table <jails> persist
nat on $ext_if from <jails> to any -> ($ext_if:0)
rdr-anchor "rdr/*"
block in all
pass out quick keep state
antispoof for $ext_if inet
anchor "blocklistd/*" in on $ext_if
anchor "f2b/*" in on $ext_if
pass in proto tcp from any to any port ssh flags S/SA keep state
The port foward is working fine from outside the server. But if I do curl https://mydomainname.com from localhost I get this error:
Immediate connect fail for IP: Connection refused
* Failed to connect to mydomainname.com port 443 after 1 ms: Could not connect to server
* closing connection #0
curl: (7) Failed to connect to mydomainname.com port 443 after 1 ms: Could not connect to server
I think this is because the lo interface is skipped, which is needed for the antispoof rule + I don’t need pf on lo other than for the port forward.
How can I get the port forward to work, also from localhost and the jails? Thank you for any insights.
