From owner-freebsd-questions@FreeBSD.ORG Fri Feb 18 11:35:30 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7E9ED16A4CE for ; Fri, 18 Feb 2005 11:35:30 +0000 (GMT) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.205]) by mx1.FreeBSD.org (Postfix) with ESMTP id E1A3243D5C for ; Fri, 18 Feb 2005 11:35:29 +0000 (GMT) (envelope-from nlamprecht@gmail.com) Received: by wproxy.gmail.com with SMTP id 69so421993wra for ; Fri, 18 Feb 2005 03:35:29 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=iLgIVd0EFwCNAT0BWVGYve1pWJM8RQdehzPJkacF9NgqJuRNuPYP0ie3hiZHaFNof517XgMZx8w1czChgWB4O3IrqF5MQnYpJCA7uVs6f2k8bdmtlji2WUi/CLUDqkHQiQz789rNRqNXBbSkETKLofgxT9wOCugkM1gegukonb8= Received: by 10.54.40.44 with SMTP id n44mr39225wrn; Fri, 18 Feb 2005 03:35:29 -0800 (PST) Received: by 10.54.38.13 with HTTP; Fri, 18 Feb 2005 03:35:28 -0800 (PST) Message-ID: <7cbadc87050218033547d9ce8d@mail.gmail.com> Date: Fri, 18 Feb 2005 13:35:28 +0200 From: Nelis Lamprecht To: perikillo In-Reply-To: <51d7a5160502171525353f3bfc@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit References: <51d7a5160502171525353f3bfc@mail.gmail.com> cc: FreeBSD Questions Subject: Re: How change the FTP_PASSIVE_MODE? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Nelis Lamprecht List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Feb 2005 11:35:30 -0000 On Thu, 17 Feb 2005 15:25:13 -0800, perikillo wrote: > Hi, i have been around reading docs about the problem we have a lot > of people went we try to access one ftp server on the Internet, > normally the (Passive servers), in the past i was using rules on > IPFILTER(freebsd 4.10 p5, think is the 3.4.31?? the one it cames > with), my rule was: > > To block all that arrives to my tun0(IN), and let out all the > packets of my internal cients over tun0 and keep state. it was easy, > only let my users go to outside world. My ipnat it was simply, only: > > map tun0 198.168.1.0/24 -> 0/32 > > With this all my clients(win2k, win98, Freebsd, win XP) where happy > and secure. > > Them i decide to change my rules be more define, i read the > handbook, and start making changes: > > Block in all over my tun0 and let out any package over my tun0 only to: > port 21, 53, 80, 443, 5999, all the handbook say, services that i know > that normally went someone surf the web he is going to connect to > those services. > > I change my nat: > > map tun0 198.168.1.0//24 -> proxy port 21 ftp/tcp > map tun0 192.168.1.0/24 -> 0/32 portmap tcp/udp 20000:60000 > map tun0 192.168.1.0/24 -> 0/32 > > Is ok, i can surf the web, but went i went to the freebsd server, > what happend: > > ftp: ls > entering passive mode(bla, bla, bla) > ftp: connect no route to host > hi, to solve your problem or you should need to do is add another rule for the actual freebsd server: map tun0 198.168.1.1/32 -> 198.168.1.1/32 proxy port ftp ftp/tcp the above rule assumes 198.168.1.1 is your freebsd server. this rule should be placed first. you should also have a rule to pass out traffic, something along the lines of: pass out quick on tun0 proto tcp from 198.168.1.0/24 to any port = 21 flags S keep state that should do the trick. cheers, nelis