Date: Wed, 8 Sep 2004 12:31:07 +0200 (CEST) From: Divacky Roman <xdivac02@stud.fit.vutbr.cz> To: FreeBSD-gnats-submit@FreeBSD.org Subject: bin/71490: ftp-proxy or rdr@pf not working Message-ID: <200409081031.i88AV7Xj031775@eva.fit.vutbr.cz> Resent-Message-ID: <200409081040.i88AeOhK072639@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 71490 >Category: bin >Synopsis: ftp-proxy or rdr@pf not working >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Sep 08 10:40:24 GMT 2004 >Closed-Date: >Last-Modified: >Originator: Divacky Roman >Release: FreeBSD 5.3-BETA3 i386 >Organization: home >Environment: FreeBSD queeg500 5.3-BETA3 FreeBSD 5.3-BETA3 #5: Tue Sep 7 13:01:38 CEST 2004 rdivacky@queeg500:/usr/obj/usr/src/sys/QUEEG i386 >Description: I've got following problem with this pf.conf ext_if="vr0" int_if="xl0" #normalize packets scrub in all altq on $ext_if bandwidth 256Kb cbq queue {ssh_i web other} queue ssh_i bandwidth 25% cbq(borrow ecn) queue web bandwidth 25% cbq(borrow ecn) queue other bandwidth 50% cbq(borrow default ecn) #nat nat on $ext_if from $int_if:network to any -> ($ext_if) #ftp redirection rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021 #rules #default to block all #block in on $ext_if all #pass all out while keeping state. and queue it pass out on $ext_if from any to any keep state queue other #queuing pass on $ext_if proto tcp from any to any port ssh keep state queue(ssh_i, other) pass out on $ext_if proto tcp from any to any port http keep state queue web #ftp proxy pass in on $ext_if inet proto tcp from any to any user proxy keep state queue other #allow icmp pass in on $ext_if inet proto icmp from any to any (notice that its in fact pass all configuration) and properly configured inetd to run ftp-proxy I tried to debug inetd it waited in this 574 if ((n = select(maxsock + 1, &readable, (fd_set *)0, (gdb) then I on the machine behind nat issued ftp command... the select stayed the same (ie. no packets arrived) and in pfctl -sa I found this: STATES: self tcp 127.0.0.1:8021 <- 195.113.15.29:21 <- 10.0.0.2:60059 CLOSED:SYN_SENT so the connection was established but then died for an unknown reason so I suppose there's something rotten in pf/ftp-proxy... (since the configuration is correct) the fbsd in question is 6-current as of: witten inetd# uname -a FreeBSD witten 6.0-CURRENT FreeBSD 6.0-CURRENT #123: Mon Sep 6 15:42:35 CEST 2004 root@witten:/usr/obj/usr/src/sys/NEOLOGISM i386 but I also got it on releng_5 simply said ftp-proxy (used to provide ftp access to outer ftp for machines behind nat) doesnt work (at least for me) thnx for looking at it >How-To-Repeat: try to set up ftp-proxy using my pf.conf and use the ftp from machines behind the nat... >Fix: I am not aware of any fix >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200409081031.i88AV7Xj031775>