关于macos上的pf redir

arm macos15
sudo ./sslocal -b "127.0.0.1:12345" --protocol redir --tcp-redir "pf" -vvvv

pf.conf
rdr pass log on lo0 proto tcp from any to 1.1.1.1 port {80,443} -> 127.0.0.1 port 12345
pass out log route-to (lo0 127.0.0.1) proto tcp from any to 1.1.1.1 port {80,443}

sudo pfctl -e -f pf.conf

这两条规则在本机执行
curl https://1.1.1.1
是正常的 能转给sslocal

但是用macos做网关时
sudo sysctl -w net.inet.ip.forwarding=1

sudo tcpdump -n -e -ttt -i pflog0
00:01:14.956086 rule 0/0(match): pass out on en0: 192.168.5.98.49298 > 1.1.1.1.80: Flags [SEW], seq 3751497900, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 188421942 ecr 0,sackOK,eol], length 0
00:00:00.000152 rule 0/0(match): rdr in on lo0: 192.168.5.98.49298 > 127.0.0.1.12345: Flags [SEW], seq 3751497900, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 188421942 ecr 0,sackOK,eol], length 0
是有日志的
5.98那边curl -v http://1.1.1.1
卡在GET / 在等待回应

sslocal这边一点反应也没有 没有日志

sudo pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 127.0.0.1:12345 <- 1.1.1.1:80 <- 192.168.5.98:49299 ESTABLISHED:ESTABLISHED

pf规则在intel macos10.15是正常的...

Start by reproducing the ARM macOS 15 gateway setup with sslocal, the shown pf.conf rules, IP forwarding, tcpdump, and pfctl -ss. Compare it with the working local curl case and the Intel macOS 10.15 behavior; done means forwarded traffic reaches sslocal and receives a response, with the relevant logs explaining the path.