Date: Fri, 06 Apr 2007 14:01:36 +0200 From: Kyrre =?iso-8859-1?Q?Nyg=E5rd?= <kyrreny@broadpark.no> To: questions@freebsd.org Subject: pf + ftpd: Socket error (Connection refused) Message-ID: <0JG200M3CS2ORAC0@osl1sminn1.broadpark.no>
next in thread | raw e-mail | index | archive | help
Hello!
My FreeBSD server (HTTP, SMTP, PF, NAT etc.) is running its native
ftpd along with pf and its ftp-proxy. But after a recent make world,
outsiders could no longer connect to this ftpd:
<--- 227 Entering Passive Mode (80,204,208,30,208,212)
---- Connecting data socket to (80.204.208.30) port 53460
**** Socket error (Connection refused)
Nor with active mode:
<--- 200 PORT command successful.
---> LIST
My server's external interface is 80.204.208.30 (ADSL), and my
internal interface is 192.168.187.1, which connects to my workstation
192.168.187.2.
All works well, except ftpd. My pf.conf was inspired by
http://www.openbsd.org/faq/pf/example1.html
##### /etc/pf.conf
ext_if="rl0"
int_if="ep0"
set block-policy return
set skip on { lo }
scrub in
nat on $ext_if from $int_if:network to any -> ($ext_if)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
rdr on $ext_if proto tcp from any to any port 53333:55555 ->
192.168.187.2 port 53333:55555
block in
pass quick on $int_if
pass out keep state
anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }
pass in on $ext_if inet proto tcp from any to ($ext_if) port {
21, 22, 25, 53, 80, 110, 113, 143 } keep state
pass in on $ext_if inet proto udp from any to ($ext_if) port 53 keep state
pass in inet proto icmp from any to any keep state
pass in on $ext_if inet proto tcp from any to any port
53333:55555 keep state
Any suggestions to improve or simplify my ruleset are warmly
welcomed. Ffor instance, why does it need 3 instances of what seems
like the same thing? nat-anchor "ftp-proxy/*", rdr-anchor
"ftp-proxy/*" and then anchor "ftp-proxy/*"?
##### /etc/inetd.conf
ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
ftp-proxy stream tcp nowait root /usr/libexec/ftp-proxy ftp-proxy
Thanks a lot for your time.
--Kyrre
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?0JG200M3CS2ORAC0>