From owner-freebsd-questions@FreeBSD.ORG Wed Jun 3 08:13:06 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C2358106566B for ; Wed, 3 Jun 2009 08:13:06 +0000 (UTC) (envelope-from sajozsattila@citromail.hu) Received: from server14.citromail.hu (server14.citromail.hu [91.83.45.14]) by mx1.freebsd.org (Postfix) with ESMTP id 2BF998FC13 for ; Wed, 3 Jun 2009 08:13:05 +0000 (UTC) (envelope-from sajozsattila@citromail.hu) Received: (qmail 28277 invoked by uid 89); 3 Jun 2009 08:13:04 -0000 Message-ID: <20090603081304.28276.qmail@server14.citromail.hu> To: FreeBSD questions Received: from 54031874.catv.pool.telekom.hu [84.3.24.116] by with HTTP; Wed, 03 Jun 2009 10:13:04 +0200 From: "=?ISO-8859-2?Q?Saj=F3_Zsolt_Attila?=" Date: Wed, 03 Jun 2009 10:13:04 +0200 Errors-To: X-Priority: 3 X-Mailer: VIPmail v.2.6 In-Reply-To: <139b44430906030032o7bb798e1rcbcf80fc9b26e46@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable Subject: Re: sshd in jail X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jun 2009 08:13:07 -0000 Thank you the help, but it doesn't work yet. I prefer the "rdr pass on $Ext inet proto tcp from any to any port 5859 -&g= t; 10.0.0.40 port 22", but I tried all ways, but absolutely nothing's chang= ed.=20 -- Eredeti =FCzenet -- Felad=F3: Valentin Bud <valentin.bud@gmail.com> C=EDmzett: Saj=F3 Zsolt Attila<sajozsattila@citromail.hu> Elk=FCldve: 09:33 T=E9ma: Re: sshd in jail 2009/6/3 Saj=F3 Zsolt Attila luk1814.no-ip.org" command I get this error: > OpenSSH_5.1p1 FreeBSD-20080901, OpenSSL 0.9.8e 23 Feb 2007 > debug1: Reading configuration data /etc/ssh/ssh_config > debug2: ssh_connect: needpriv 0 > debug1: Connecting to luk1814.no-ip.org [84.3.27.205] port 5859. > debug1: connect to address 84.3.27.205 port 5859: Connection refused > ssh: connect to host luk1814.no-ip.org port 5859: Connection refused > > > The "pfctr -sn" command output's: > nat on vr0 inet from 10.0.0.20 to any -> (vr0) round-robin > nat on vr0 inet from 10.0.0.40 to any -> (vr0) round-robin > rdr on vr0 inet proto tcp from any to any port =3D 5859 -> 10.0.0.4= 0 port > 22 > > > My pf.conf: > Ext =3D "vr0" # output interface > Loop =3D "lo0" # Loopback interface > IntNet1=3D"10.0.0.20" # Jail 1 > IntNet2=3D"10.0.0.40" # Jail 2 this is running the sshd > NoRoute =3D "{ 127.0.0.1/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, > 255.255.255.255/32 }" > InServicesTCP =3D "{ ssh, http, https }" > OutServicesTCP =3D "{ http, https, whois, domain, ssh, ftp, ftp-data, = nntp, > 1863, 8880 }" > OutServicesUDP =3D "{ ntp, domain }" > NowDeny =3D "{ 445, 67, 68 }" > X11 =3D "{ 6010, 5900}" > Timeserver =3D "{ 148.6.0.1 }" > CVSupServers =3D "{ 212.19.57.134 }" > CVSupPorts =3D "{ 5999 }" > DynDNSServer =3D "{ 63.208.196.94 }" > DynDNSPorts =3D "{ 8245 }" > scrub in on $Ext all > altq on $Ext priq bandwidth 100Kb queue { q_pri, q_def } > queue q_pri priority 7 > queue q_def priority 1 priq(default) > nat on $Ext from $IntNet1 to any -> ($Ext) > nat on $Ext from $IntNet2 to any -> ($Ext) > rdr on $Ext proto tcp from any to any port 5859 -> $IntNet2 port 22 > block in quick on $Ext proto { tcp, udp} from any to any port $NowDeny > block out log on $Ext all > block in log on $Ext all > block return-rst out log on $Ext proto tcp all > block return-rst in log on $Ext proto tcp all > block return-icmp out log on $Ext proto udp all > block return-icmp in log on $Ext proto udp all > block in log quick on $Ext inet proto tcp from any to any flags FUP/FU= P > block in log quick on $Ext inet proto tcp from any to any flags SF/SFR= A > block in log quick on $Ext inet proto tcp from any to any flags /SFRA > block in log quick on $Ext from $NoRoute to any > block out log quick on $Ext from any to $NoRoute > block in quick on $Ext from any to 255.255.255.255 > pass in quick on $Ext proto tcp from any to $IntNet2 port 8022 keep st= ate > > pass in quick on $Loop all > pass out quick on $Loop all This two could be changed to 'set skip on lo0' in the pf OPTIONS section. > > pass out quick on $Ext inet proto tcp from any to any port > 1024 f= lags > S/SA keep state > pass out quick on $Ext inet proto icmp all icmp-type 8 code 0 keep sta= te > pass in log quick on $Ext inet proto icmp all icmp-type 8 code 0 keep = state > pass in quick on $Ext inet proto tcp from any to any port $InServicesT= CP > flags S/SA keep state > pass out quick on $Ext inet proto udp from any to any port $OutService= sUDP > keep state > pass out quick on $Ext inet proto tcp from any to any port $OutService= sTCP > flags S/SA modulate state > pass out quick on $Ext inet proto tcp from any to $CVSupServers port > $CVSupPorts flags S/SA modulate state > pass out quick on $Ext inet proto tcp from any to $Timeserver port tim= e > flags S/SA modulate state > pass out quick on $Ext inet proto tcp from any to any port { > 6880> pass in quick on $Ext inet proto tcp from any to any port 688= 0> flags S/SAFR keep state > anchor passin > > > Somebody knows why doesn't work the rdr? > You don't have a pass rule for the 5859 port. You can, however, accomplish what you want in a couple of ways. 1. use the pass keyword in rdr rdr *pass* on vr0 inet proto tcp from any to any port =3D 5859 -> 10.0.0= .40 port 22 2. a separate pass in rule pass in quick on $Ext inet proto tcp from any to any port 5859 flags S/SA keep state. 3. simply add 5859 port to $InServicesTCP macro. a great day, v > > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to " > freebsd-questions-unsubscribe@freebsd.org" > --=20 network warrior since 2005 _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org= "