Re: [squid-users] Transparent Proxy on OpenBSD 5.3 with Squid 3.2.7

On Mon, Nov 04, 2013 at 04:33:29PM +0100, Marko Cupać wrote:
>On Mon, 4 Nov 2013 16:05:38 +0100
>Marc Sontowski <marc_at_sontowski.net> wrote:
>
>> # Pass all traffic to and from the local network, using quick so that later
>> # rules are not evaluated if a packet match this. Some rulesets would restrict
>> # local traffic much further
>> pass quick on $int_if all
>
>As comment says, quick keyword makes later rules being not evaluated if
>a packet match this. Try to add:
>
>> pass in quick on $ext_if proto tcp from 192.168.2.0/24 to port www divert-to 127.0.0.1 port 3128
>
>above line that passes all quick on $int_if.
>
>--
>Marko Cupać
>

Thanks Marko!
my /etc/pf.conf looks like that now:

---
# The internal interface (connected to the local network)
ext_if="em0"
# The external interfaces (connected to the ipv4 and ipv6 network)
int_if="em1"
## Options
set loginterface $ext_if
set optimization aggressive
# scrub incomming packets
match on egress scrub  (no-df)
# Set the default policy to return RSTs or ICMPs for blocked traffic
set block-policy drop
# Ignore the loopback interface entirely
set skip on lo0
anchor "ftp-proxy/*"
pass in quick on $int_if inet proto tcp to any port ftp \
divert-to 127.0.0.1 port 8021
## Translation rules
# NAT traffic on the interface in the default egress interface group (to
# which the interface out of which the default route goes is assigned) from the
# local network
match out on egress inet from $int_if:network to any nat-to (egress)
## Filtering rules
# Default deny rule. which all blocked packets logged.
block log all
block in log on $ext_if all
antispoof log for egress
#squid transparent
pass in quick on $ext_if proto tcp from 192.168.2.0/24 to port www divert-to 127.0.0.1 port 3128
pass out quick from 127.0.0.1 divert-reply
# Pass all traffic to and from the local network, using quick so that later
# rules are not evaluated if a packet match this. Some rulesets would restrict
# local traffic much further
pass out quick
---
But it doesn't work :-(
-- 
Marc Sontowski