I'm trying to configure a NAT redirection with Pfctl on my macOS (Ventura 13.2). I want to achieve a redirection for a specific IP and port to another IP (which is reachable through VPN) and the same port, more specifically:

rdr pass on utun3 inet proto tcp from any to port = 6443 -> <OTHER_IP> port 6443

My first question is if this is the correct rule for this approach.

As you can notice, I'm using the utun3 interface, as it's the VPN interface that receives an IP when the VPN is active. There are other utun<x> interfaces as well so I believe this is the proper interface to configure.

I've enabled net.inet.ip.forwarding: 1, and I'm trying to set the rule above in /etc/pf.conf.

I create a custom anchor in /etc/pf.anchors/custom_anchor and loaded in the pf.conf but with no luck, I could not get any ouput that the rule was loaded from sudo pfctl -sr.

Then I tried to place it under rdr-anchor "com.apple/*" and have reloaded the pfctl.

However, after adding this rule and reloading pfctl, I'm not able to see the rules being loaded when I run sudo pfctl -sr. Here is the output:

No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
anchor "com.apple/*" all

And here is the output of sudo pfctl -a com.apple -sr:

No ALTQ support in kernel
ALTQ related functions disabled
anchor "200.AirDrop/*" all
anchor "250.ApplicationFirewall/*" all

The sudo pfctl -si command shows that the pf service is running.

Are there any other relevant configurations or steps that I should be aware of? I appreciate any assistance with this issue. Thanks!


You must log in to answer this question.

Browse other questions tagged .