I have a Proxmox installed and an OpenBSD VM in front of all the others to play the role of NAT, firewall, DNS and DHCP.I have a fully functional DNS and DHCP. My DHCP is correctly updating my DNS records.My NAT is also working well since my other VMs can reach the internet.Now I would like to have a working firewall and incoming NAT rules.For instance I have a VM named nginx, which can be contacted though nginx.local.lan.In short terms, this is what I want to do:Redirect 80 and 443 ports to my ngnix.local.lan.Block everything that comes from the WAN interface (em0) except what is natted (80 and 443 to nginx) and SSH.But I also want to allow everything that comes from the LAN interface (em1).Since I'm a beginner with PF, I'm quite lost... How do I do that?Here is my current pf.conf file: set skip on lo block return    # block stateless traffic pass            # establish keep-state # Define interfaces ext_if=em0 int_if=em1 # Allow SSH connections pass in on $ext_if inet proto tcp from any to ($ext_if) port 22 # Allow VMs to get out of the network pass out on $ext_if inet from $int_if:network to any nat-to $ext_if
OpenBSD pf NAT rules based on DHCP/DNS
openbsd;pf
I finally found a way to do everything I said before.I'm going to explaining it:In /etc/pf.conf:Denying all incoming trafic(Except the LAN interface) block in all pass in quick on $int_ifThe first line block eveything while the second one allow anything from the LAN interface.If you wonder what the quick keyword is, read this.How can you be sure it's working? Just do a pfctl -sr, it should output something like:  block drop in all pass in quick on em1 all flags S/SARedirecting the HTTP(S) traffic to a VMAs said before, I already configured a working DNS, DHCP, DDNS setup. Which means that if I have an nginx VM that's asking for a DHCP lease, it'll automatically associate the nginx.local.lan entry of the domain to the leased IP.Knowing that, I tried to make it elegent in the config file using macro :nginx_vm_map=80 443pass in quick on $ext_if proto tcp from any to any port {$nginx_vm_map} rdr-to nginx.local.lanThe first line define the ports I want to redirect to my VM, then I use this macro $nginx_vm_map inside the natting rule to make it easily changeable.