pf and a natted jailed web server

[David Mehler]

Hello,

I'm running FreeBSD 10.3 in a vps. I've got one public IP and am
running a jail server using /etc/jail.conf.

My problem is I'm trying to pass in port 8080 traffic in to the jailed
web server which then goes to port 80 which the jailed web server has
a web server listening on.

My problem is either the pf nat or rdr is not happy and I've been on
this for several hours and it's running together. To me the
configuration looks right.

A separate maybe related problem maybe not is that when I create a new
jail then bring it up it gets a new ip on lo1 for example 10.0.0.16 in
order to allow that jail to the network I have to reload my pf rules.
Is this correct behavior?

Any help appreciated. My pf.conf is below.

Thanks.
Dave.

pf.conf:
ext_if="fxp0"
int_if = "lo1"
jailnet = $int_if:network
icmp_types="echoreq"
icmp6_types="{ 2, 128 }" # packet too big, echo request (ping6)
# Neighbor Discovery Protocol (NDP) (types 133-137):
#   Router Solicitation (RS), Router Advertisement (RA)
#   Neighbor Solicitation (NS), Neighbor Advertisement (NA)
#   Route Redirection
icmp6_types_ext_if="{ 128, 133, 134, 135, 136, 137 }"
synstate ="flags S/SA synproxy state"
tcpstate ="flags S/SA modulate state"
udpstate ="keep state"

# Name and IP of jails
webmail="10.0.0.15"

# allowed traffic
tcp_services="{bootpc, bootps, ftp-data, ftp, ssh, domain, smtp, http,
https, imap, imaps, 3690, 7, 2703 587}"
udp_services="{bootpc, bootps, domain, ntp, 3690, 6277, 24441}"

# Options
set block-policy return
set skip on lo0
set skip on lo1
scrub on $ext_if all reassemble tcp no-df random-id max-mss 1440

# NAT
nat on $ext_if inet from $jailnet to any -> ($ext_if)

# Redirect any packets requesting port 8080 or 4430 to jailed webserver
rdr pass on $ext_if inet proto tcp from any to any port 8080 ->
$webmail port http

# Tables
table <bruteforce> persist file "/etc/pf/bruteforce"

# Pass anything on the lo* interfaces
pass quick on lo0 all
pass quick on lo1 all

# Block by default
block all

# Explicitly block unroutable addresses
antispoof quick for ($ext_if)

# Explicitly block anything in the bruteforce table
block quick from <bruteforce>

# Pass out only the desired ports from host and jails
pass quick proto tcp from {self} to port $tcp_services keep state
(max-src-conn 100, max-src-conn-rate 15/5, overload <bruteforce> flush
global)
pass quick proto tcp from $jailnet to port $tcp_services keep state
(max-src-conn 100, max-src-conn-rate 15/5, overload <bruteforce> flush
global)
pass quick proto {tcp, udp} from {self} to port $udp_services keep state
pass quick proto {tcp, udp} from $jailnet to port $udp_services keep state

# allow ping
pass inet proto icmp icmp-type $icmp_types keep state

# Traceroute
# allow out the default range for traceroute(8):
  # ”base+nhops*nqueries-1” (33434+64*3-1)
pass inet proto udp to port 33433:33626 # For IPv4

# allow https traffic out from the jails
pass out proto tcp from $jailnet port https to any keep state

 # Allow ssh connections in from the internet
pass in proto tcp from any to $ext_if port ssh keep state

# Pass in http traffic from the internet
pass in inet proto tcp to $ext_if port 80 keep state

# Pass in https traffic from the internet
pass in inet proto tcp to $ext_if port 443 keep state

# Pass in smtp traffic from the internet
pass in inet proto tcp to $ext_if port 25 keep state

# Pass in submission traffic from the internet
pass in inet proto tcp to $ext_if port 587 keep state

# Pass in imaps traffic from the internet
pass in inet proto tcp to $ext_if port 993 keep state

# Pass in port 8080 to the jailed web server
#pass in inet proto tcp to $webmail port 80 keep state

# IPv6
pass quick on $ext_if inet6 proto ipv6-icmp icmp6-type $icmp6_types keep state
pass quick on $ext_if inet6 proto ipv6-icmp from any to { ($ext_if ),
ff02::/16 } icmp6-type $icmp6_types_ext_if keep state