New syntax for "nat" and "rdr"

[joseche]

Hi all, I just upgraded to 4.6-stable and I'm having two syntax errors on /etc/pf.conf I just can't figure out:

pass in on $int_if inet proto tcp from 172.16.0.0/12 to any port www rdr-to 127.0.0.1 port 3128

pass out on $ext_if from 172.16.0.0/12 to any nat-to $ext_if

Any idea ?

[jggimi]

My nat-to uses match, instead of pass, as it is very general:

match out on $external_nic from !($external_nic) nat-to ($external_nic)

A rdr-to line, note the from, and no use of on:

pass in log quick proto tcp from $internal_net to any port www \
        rdr-to 127.0.0.1 port 8080

[joseche]

I just found that the problem was when updating from 4.6-current to 4.6-stable, 4.6-current uses nat-to and rdr-to, and 4.6-stable uses the old syntax....

thanks!

[jggimi]

Oh, yes.

The reason -stable is called "stable" is that it is functionally equivalent to the -release. FAQ 5.1 has a detailed explanation.

I'm a -current user, so I'm not always aware of what specific new functionality I'm using may be beyond -release/-stable. I recall going through the nat/rdr transition, but I didn't remember if it was before or after 4.6 was finalized.