Date: Thu, 7 Jul 2005 14:25:49 -0400 From: Scott Ullrich <sullrich@gmail.com> To: Michael Weiser <michael@weiser.dinsnail.net> Cc: freebsd-pf@freebsd.org Subject: Re: pftpx rules not showing in pfctl Message-ID: <d5992baf05070711252160e8b1@mail.gmail.com> In-Reply-To: <20050707181620.GA57981@weiser.dinsnail.net> References: <20050707181620.GA57981@weiser.dinsnail.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On 7/7/05, Michael Weiser <michael@weiser.dinsnail.net> wrote:
> Hello,
>=20
> this may sound ridiculous but I've actually managed to set up pftpx and
> now can't seem to figure out why it works. :)
>=20
> I've compiled pftpx on my FreeBSD-CURRENT box with some minor tweaking
> because of missing stnvis. I added the required rules to my pf.conf:
>=20
> nat-anchor "pftpx/*"
> rdr-anchor "pftpx/*"
> rdr on $intif inet proto tcp from any to any port 21 -> 127.0.0.1 port 8=
021
>=20
> and
>=20
> anchor "pftpx/*" on $dslif
> pass out quick on $dslif inet proto tcp from $dslif port $unpriv to any p=
ort =3D ftp modulate state (no-sync) flags S/SA label $dslif-out-ftp
>=20
> $dslif is xl0 for me. It's present on the anchor because I also have a
> $pppif tun0 which is used occasionally and rules for it are defined
> further down the filter list.
>=20
> Anyway. I fired up pftpx -d -D 7 and lo, everything works nicely.
>=20
> Then I went and said 'pfctl -a pftpx -s r' whilst running an ftp
> download. No matter what I do, it says the rule list is empty. When
> running it with '-s a' I see that there are entries for the ftp
> connections in the state table, but still no rules.
>=20
> Is it supposed to behave that way or should I be seeing some rule
> entries?
First do this:
pfctl -sA -v | grep pftpx
# pfctl -sA -v | grep pftpx
pftpx
pftpx/419.1
Then do a:
# pfctl -v -a pftpx/419.1 -sr
pass in log quick inet proto tcp from 204.152.184.73 to 10.0.0.69 port
=3D commplex-link flags S/FSRA keep state (max 1)
[ Evaluations: 1071 Packets: 8 Bytes: 501 States: 0 =
]
pass out log quick inet proto tcp from 204.152.184.73 to 10.0.0.69
port =3D commplex-link flags S/FSRA keep state (max 1)
[ Evaluations: 286 Packets: 8 Bytes: 501 States: 0 =
]
This will show your rules. ;)
Regards,
Scott
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?d5992baf05070711252160e8b1>