From owner-freebsd-questions@FreeBSD.ORG Sun Feb 20 07:24:03 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9449B16A4CE for ; Sun, 20 Feb 2005 07:24:03 +0000 (GMT) Received: from rproxy.gmail.com (rproxy.gmail.com [64.233.170.207]) by mx1.FreeBSD.org (Postfix) with ESMTP id C9F2C43D45 for ; Sun, 20 Feb 2005 07:24:02 +0000 (GMT) (envelope-from perikillo@gmail.com) Received: by rproxy.gmail.com with SMTP id a41so124004rng for ; Sat, 19 Feb 2005 23:24:02 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=mNDbW4EbgOa5nU2KsImEvOgLpWgR8alaQjZv/JTde1PvV032K6/jKD1DDVAacN6fT4x2EzCXabberLAC0W9JUocnasls24yT51F7337JWvOSCGE3FNhBr3uqY1Vn+t3mf2ZsAfb9xWXZxnDt9pjauq2rFNpkPrV4pOIJ/FlkkLA= Received: by 10.38.68.14 with SMTP id q14mr524382rna; Sat, 19 Feb 2005 23:24:02 -0800 (PST) Received: by 10.38.98.35 with HTTP; Sat, 19 Feb 2005 23:24:01 -0800 (PST) Message-ID: <51d7a5160502192324f17fb9d@mail.gmail.com> Date: Sat, 19 Feb 2005 23:24:01 -0800 From: perikillo To: freebsd-questions@freebsd.org In-Reply-To: <51d7a5160502180858643e2bdc@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit References: <51d7a5160502171525353f3bfc@mail.gmail.com> <7cbadc87050218033547d9ce8d@mail.gmail.com> <51d7a5160502180858643e2bdc@mail.gmail.com> cc: questions@freebsd.org Subject: Re: How change the FTP_PASSIVE_MODE? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: perikillo List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Feb 2005 07:24:03 -0000 FTP Passive problems fix. After making some test with different advices from this and another list i could fix my problem, the situation was that went i was trying to access ftp.freebsd.org, i cannot use the ls command, them someone say: --Use the IP address of the server you want to access map tun0 192.168.0.1/24 -> 204.152.184.73/32 proxy port ftp ftp/tcp map tun0 192.168.0.1/24 -> 0/32 proxy port ftp ftp/tcp map tun0 192.168.0.1/24 -> 0/32 portmap 20000:60000 map tun0 192.168.0.1/24 -> 0/32 Results: ftp> ls no route to host ---Use the port 20 on ipf.rules some servers works like. pass out quick on tun0 proto tcp from any to any port 21 flags S keep state pass out quick on tun0 proto tcp from any to any port 20 flags S keep state /etc/ipnat.rules the same Results: ftp> ls no route to host --Them after read, change, save, test, with ipnat this two scripts make the job: map tun0 0/0 -> 0/32 proxy port ftp ftp/tcp map tun0 0/0 -> 0/32 portmap 20000:60000 map tun0 0/0 -> 0/32 and map tun0 192.168.0.1/0 -> 0/32 proxy port ftp ftp/tcp map tun0 192.168.0.1/0 -> 0/32 portmap 20000:60000 map tun0 192.168.0.1/0 -> 0/32 Delete the port 20 from /etc/ipf.rules set enviroment var FTP_PASSIVE_MODE no ipf# setenv FTP_PASSIVE_MODE no Result: ftp> ls bla bla bla...................etc bla bla bla...................pub OK, my rules are working, now i need to check wich script is better, i still have the doubt on:-? The machine that was having this problems was my firewall unsing Freebsd 4.11 release, IPFILTER on kernel v3.4.35, sometimes i need to access the freebsd servers to check information and found this problems, but they are resolved ;-). my client win2k is working very well Firefox 1.0 www and ftp ok Explorer 6.0 www and ftp ok cmd ftp ok I only need to read about this two scripts, any information about the differents i will apreciate. Thanks. On Fri, 18 Feb 2005 08:58:46 -0800, perikillo wrote: > On Fri, 18 Feb 2005 13:35:28 +0200, Nelis Lamprecht > wrote: > > On Thu, 17 Feb 2005 15:25:13 -0800, perikillo wrote: > > > Hi, i have been around reading docs about the problem we have a lot > > > of people went we try to access one ftp server on the Internet, > > > normally the (Passive servers), in the past i was using rules on > > > IPFILTER(freebsd 4.10 p5, think is the 3.4.31?? the one it cames > > > with), my rule was: > > > > > > To block all that arrives to my tun0(IN), and let out all the > > > packets of my internal cients over tun0 and keep state. it was easy, > > > only let my users go to outside world. My ipnat it was simply, only: > > > > > > map tun0 198.168.1.0/24 -> 0/32 > > > > > > With this all my clients(win2k, win98, Freebsd, win XP) where happy > > > and secure. > > > > > > Them i decide to change my rules be more define, i read the > > > handbook, and start making changes: > > > > > > Block in all over my tun0 and let out any package over my tun0 only to: > > > port 21, 53, 80, 443, 5999, all the handbook say, services that i know > > > that normally went someone surf the web he is going to connect to > > > those services. > > > > > > I change my nat: > > > > > > map tun0 198.168.1.0//24 -> proxy port 21 ftp/tcp > > > map tun0 192.168.1.0/24 -> 0/32 portmap tcp/udp 20000:60000 > > > map tun0 192.168.1.0/24 -> 0/32 > > > > > > Is ok, i can surf the web, but went i went to the freebsd server, > > > what happend: > > > > > > ftp: ls > > > entering passive mode(bla, bla, bla) > > > ftp: connect no route to host > > > > > > > hi, > > > > to solve your problem or you should need to do is add another rule for > > the actual freebsd server: > > > > map tun0 198.168.1.1/32 -> 198.168.1.1/32 proxy port ftp ftp/tcp > > > > the above rule assumes 198.168.1.1 is your freebsd server. this rule > > should be placed first. you should also have a rule to pass out > > traffic, something along the lines of: > > > > pass out quick on tun0 proto tcp from 198.168.1.0/24 to any port = 21 > > flags S keep state > > > > that should do the trick. > > > > cheers, > > nelis > > >