Date: Thu, 7 Jan 2010 21:37:27 +0100 From: J65nko <j65nko@gmail.com> To: "M. Keith Thompson" <m.keith.thompson@gmail.com> Cc: freebsd-pf@freebsd.org Subject: Re: ftp problem Message-ID: <19861fba1001071237ncc440d5u1ab280d2aaf0c72f@mail.gmail.com> In-Reply-To: <2cf1d0681001071216p6b516e9egcf7401f2b38e3c3d@mail.gmail.com> References: <fc2243911001060809m5417b810vf2ed40c8a969fb5f@mail.gmail.com> <7731938b1001060923n5de4b511of07b8c63cff4e011@mail.gmail.com> <fc2243911001060957n16f906f7m703c696b970e8c3c@mail.gmail.com> <2cf1d0681001071216p6b516e9egcf7401f2b38e3c3d@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> # SSH from NetEng subnet > pass in quick log on $ext_if proto tcp from $net_eng to $ext_if port > 22 keep state > > # Allow inside network to ping the server > pass in quick on $ext_if proto icmp from $pingers to $ext_IP keep state > > # Allow DNS lookups > pass out quick on $ext_if proto udp to any port 53 > pass out quick on $ext_if proto tcp to any port 53 keep state > > # Allow ftp > pass in quick on $ext_if proto tcp from any to $ext_IP port 21 keep state > pass in quick on $ext_if proto tcp from any to $ext_IP port > 49151 keep state > pass in quick on $ext_if proto tcp from any port > 10000 to $ext_IP > port 20 keep state > > --- end of pf.conf ---------------------- To prevent problems with TCP window scaling you should create state on only the first packet of the 3 way TCP handshake, the packet with only the Syn flag set. With pf you do this by using 'keep state flags S/SA". This TCP window scaling issue is explained by Daniel Hartmeier, pf hacker, in http://undeadly.org/cgi?action=article&sid=20060928081238 under the section "Create TCP states on the initial SYN packet" BTW I wonder why you don't use the pf ftp-proxy, and why you allow active ftp transfers ;)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19861fba1001071237ncc440d5u1ab280d2aaf0c72f>