From owner-freebsd-pf@FreeBSD.ORG Tue Mar 4 00:08:05 2008 Return-Path: Delivered-To: pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DF0EA106566B for ; Tue, 4 Mar 2008 00:08:04 +0000 (UTC) (envelope-from mksmith@adhost.com) Received: from mail-defer01.adhost.com (mail-defer01.adhost.com [216.211.128.150]) by mx1.freebsd.org (Postfix) with ESMTP id C84BE8FC17 for ; Tue, 4 Mar 2008 00:08:04 +0000 (UTC) (envelope-from mksmith@adhost.com) Received: from mail-in01.adhost.com (mail-in01.adhost.com [10.212.3.11]) by mail-defer01.adhost.com (Postfix) with ESMTP id 24785EBD93 for ; Mon, 3 Mar 2008 15:48:54 -0800 (PST) (envelope-from mksmith@adhost.com) Received: from ad-exh01.adhost.lan (unknown [216.211.143.69]) by mail-in01.adhost.com (Postfix) with ESMTP id 47BA361C26 for ; Mon, 3 Mar 2008 15:48:53 -0800 (PST) (envelope-from mksmith@adhost.com) MIME-Version: 1.0 X-MimeOLE: Produced By Microsoft Exchange V6.5 x-pgp-mapi-encoding-version: 2.5.0 x-cr-hashedpuzzle: Aamy B5Pa B/nm CMTz CZ55 DnD2 EGbq EYzM ExLs FvvH Hjqp H56u I0zx JhBk J6A7 KGd5; 1; cABmAEAAZgByAGUAZQBiAHMAZAAuAG8AcgBnAA==; Sosha1_v1; 7; {635CE9B4-AD2A-4CD6-AECD-2968805C5CC7}; bQBrAHMAbQBpAHQAaABAAGEAZABoAG8AcwB0AC4AYwBvAG0A; Mon, 03 Mar 2008 23:48:50 GMT; QwBvAG4AZgB1AHMAaQBvAG4AIABhAGIAbwB1AHQAIABQAEYAIABhAG4AZAAgAEYAVABQAA== Content-Type: multipart/signed; boundary="PGP_Universal_0FFA6029_72C37056_E5CADDAF_46FFE0BA"; protocol="application/pgp-signature"; micalg=pgp-sha1 x-cr-puzzleid: {635CE9B4-AD2A-4CD6-AECD-2968805C5CC7} x-pgp-encoding-format: MIME x-pgp-encoding-version: 2.0.2 Content-class: urn:content-classes:message Date: Mon, 3 Mar 2008 15:48:50 -0800 Message-ID: <17838240D9A5544AAA5FF95F8D5203160369992A@ad-exh01.adhost.lan> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Confusion about PF and FTP Thread-Index: Ach9iR4MtGqaZgmMTqCsZDANkCgqWw== From: "Michael K. Smith - Adhost" To: Cc: Subject: Confusion about PF and FTP X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Mar 2008 00:08:05 -0000 --PGP_Universal_0FFA6029_72C37056_E5CADDAF_46FFE0BA Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: QUOTED-PRINTABLE Hello All: I am confused about using FTP through PF. We have been running with a work= ing ftp-proxy setup that allows our internal servers to ftp out with no tro= uble. I am now interested in putting an FTP server behind my PF configurat= ion and I've not been too successful. If I am running an FTP server, is it necessary to proxy the connections thr= ough the PF boxes or can I just allow the FTP connections through PF to tho= se servers? If it's necessary, does anyone have a configuration that will = work for an FTP server servicing inbound FTP connections from the Internet = to a server behind PF? I have tried using ftp-proxy and pftpx, but the configuration guidelines fr= om the MAN pages of both don't see to work. I actually used them verbatim.= Finally, this is FreeBSD 6.3p1 with the default PF. Here's what I have relevant to ftp at the moment, where liv_ftp_int is behi= nd PF, liv_ftp_ext is in front. $vlan2_if is the outside interface on a va= lid IP and $vlan924_if is the inside interface on the 10.214 subnet (10.214= .0.1) which serves as the default gateway for the subnet. liv_ftp_int=3D"10.214.0.13" liv_ftp_ext=3D"x.x.x.x" table persist { \ $liv_ftp_ext, \ nat-anchor "ftp-proxy/*" nat on $vlan2_if from $liv_ftp_int to any -> $liv_ftp_ext rdr-anchor "ftp-proxy/*" rdr on $vlan2_if proto tcp from any to port 21 -> 127.0.0.1 p= ort 8021 rdr on ! $vlan924_if proto tcp from any to $liv_ftp_ext port 21 -> $liv_ftp= _int rdr on ! $vlan924_if proto tcp from any to $liv_ftp_ext port 20 -> $liv_ftp= _int rdr on ! $vlan924_if proto tcp from any to $liv_ftp_ext port 443 -> $liv_ft= p_int block in quick on $vlan2_if proto tcp from any to ! port 21 anchor "ftp-proxy/*" Regards, Mike --PGP_Universal_0FFA6029_72C37056_E5CADDAF_46FFE0BA Content-Type: application/pgp-signature; name="PGP.sig" Content-Transfer-Encoding: 7BIT Content-Disposition: attachment; filename="PGP.sig" -----BEGIN PGP SIGNATURE----- Version: 9.8.0 (Build 2158) iQEVAwUBR8yOYvTXQhZ+XcVAAQgbLgf/cr5Xj6FypYMrrbu1T0yhIRbLVvkrXMxp 0pd4moNRavgJCCwb1Q0MqwGsLNsKYS48HTrvOnQ1nBr3KnCQiDVpUaeI3VntkTa+ XVuhK1BoM+4/N4i7BRB/5MNQY4yYUQOyc+OsO32rcNb+JHY/UYqJN5lfMN5xmCln zGXquCono4JyIHqRWIbPKNDHIPh0OI5F9w8oJMMU7zhep3VJvvtY9tyWRawEpepG 6PqV+Qv7WFQprvsDUS0YmQyjp/ozugJB7PY5rMrzhjZ+vCMlMf/I/iorvZxfBXIS IJ22OQ6zrqFJl5Xk2DwX2/XX4dfwLJ0QRti+83wqCfWLnd+H1px6OA== =dRl1 -----END PGP SIGNATURE----- --PGP_Universal_0FFA6029_72C37056_E5CADDAF_46FFE0BA--