From owner-freebsd-questions@FreeBSD.ORG Fri Jun 10 21:22:39 2005 Return-Path: X-Original-To: questions@freebsd.org Delivered-To: freebsd-questions@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5E87616A420 for ; Fri, 10 Jun 2005 21:22:39 +0000 (GMT) (envelope-from fteg@london.com) Received: from webmail-outgoing.us4.outblaze.com (webmail-outgoing.us4.outblaze.com [205.158.62.67]) by mx1.FreeBSD.org (Postfix) with ESMTP id F381743D58 for ; Fri, 10 Jun 2005 21:22:38 +0000 (GMT) (envelope-from fteg@london.com) Received: from unknown (unknown [192.168.9.180]) by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id 639111800133 for ; Fri, 10 Jun 2005 21:22:38 +0000 (GMT) X-OB-Received: from unknown (205.158.62.49) by wfilter.us4.outblaze.com; 10 Jun 2005 21:22:38 -0000 Received: by ws1-1.us4.outblaze.com (Postfix, from userid 1001) id 5809D4BEAD; Fri, 10 Jun 2005 21:22:38 +0000 (GMT) Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="iso-8859-1" MIME-Version: 1.0 X-Mailer: MIME::Lite 2.117 (F2.6; A1.17; B2.12; Q2.03) Received: from [213.187.181.70] by ws1-1.us4.outblaze.com with http for fteg@london.com; Fri, 10 Jun 2005 16:22:38 -0500 X-Mailer: mail.com webmail From: "Fafa Hafiz Krantz" To: questions@freebsd.org Date: Fri, 10 Jun 2005 16:22:38 -0500 X-Originating-Ip: 213.187.181.70 X-Originating-Server: ws1-1.us4.outblaze.com Message-Id: <20050610212238.5809D4BEAD@ws1-1.us4.outblaze.com> Cc: Subject: pf pfffffft pfft *) problem X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jun 2005 21:22:39 -0000 hey! pf blocks me from ftp'ing out from my workstation (behind my pf box) and i = don't know why. it only blocks, however, the ftp's i've been downloading a lot from during = the past few days. ftp'ing out *from* my pf box works just nicely. some of my users report not being able to ssh in, too. # tcpdump -n -e -ttt -i pflog0 # 24. 001750 rule 0/0(match): block in on rl0: IP 217.31.174.134:2200 > 213.1= 87.181.23 : FP 0:34(34) ack 1 win 5840 heeeeeeelp! :D i didn't change my working configuration. it's been working for months. until now ... # cat /etc/pf.conf # int_if=3D"ep0" ext_if=3D"rl0" set block-policy drop scrub in all nat on $ext_if from $int_if:network to any -> ($ext_if) rdr on $int_if proto tcp from any to any \ port 21 -> 127.0.0.1 port 8021 block drop log all pass quick on { lo0 $int_if } pass out on $ext_if inet proto { tcp, udp, icmp } \ from any to any keep state pass in on $ext_if inet proto { tcp, udp } \ from any to ($ext_if) port 53 pass out on $ext_if inet proto { tcp, udp } \ from any port 53 to any pass out on $ext_if inet proto udp \ from any to any port 123 keep state pass in on $ext_if inet proto tcp \ from any to ($ext_if) port { 22, 25, 80, 110, 113, 143 } \ flags S/SA keep state pass in on $ext_if inet proto tcp \ from any port 20 to ($ext_if) user proxy flags S/SA keep state pass in on $ext_if proto tcp \ from any to any port 31337 keep state pass in on $ext_if proto tcp \ from any to any port 53333:55555 -- Fafa Hafiz Krantz Research Designer @ http://www.home.no/barbershop Enlightened @ http://www.home.no/barbershop/smart/sharon.pdf --=20 ___________________________________________________________ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm