Date: Wed, 14 Oct 2015 20:04:36 -0400 From: David Mehler <dave.mehler@gmail.com> To: freebsd-pf <freebsd-pf@freebsd.org> Subject: FreeBSD 10, pf and ftp Message-ID: <CAPORhP5gctSpskHiW=_UxgepjrN1R_pm1FiLG57SDpVuwSRS_A@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Hello,
I've got pf and ftp-proxy loading, the latter is listening on
127.0.0.1:8021 and I've got the below rules. Any ftp traffic from the
host to an ftp server is not working. Can someone tell me where I
messed up with the proxy?
Thanks.
Dave.
#
# pf.conf rules
# Establish a block by default firewall, allow all outbound traffic, b
ut only allow ports on the list inbound
#
# define the external interface
ext_if="vtnet0"
# Set options
# block-policy can be either drop or return
set block-policy drop
# Avoid doing anything with the lo0 loopback interface
set skip on lo0
scrub on $ext_if all reassemble tcp no-df random-id max-mss 1440
# for the ftp proxy
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on $ext_if inet from !($ext_if) -> ($ext_if:0)
rdr pass on $ext_if proto tcp from any to any port ftp -> 127.0.0.1 port 8021
antispoof quick for ($ext_if)
# Set up tables for IP blocking
table <childrens> persist
table <chuugoku> persist file "/etc/pf/zones/cn.zone"
table <ru> persist file "/etc/pf/zones/ru.zone"
icmp_types = "echoreq"
icmp6_types = "ipv6-icmp"
# Define services we want to allow out
tcp_services = "{ ftp-data, ftp, ntp, bootpc, bootps, domain, ssh,
smtp, www, https, imap, imaps }"
udp_services = "{ bootpc, bootps, domain, ntp }"
# block by default
block all
# Block anything in the childrens table
block in quick proto tcp from <childrens> to any
block in quick proto tcp from <chuugoku> to any port { 80 22 25 }
block in quick proto tcp from <ru> to any port { 80 22 25 }
# pass out any traffic from the host
pass out quick proto tcp to any port $tcp_services keep state
pass out quick proto udp to any port $udp_services keep state
# Allow ssh connections in from the internet
pass in quick inet proto tcp to $ext_if port ssh flags S/SA keep state
(max-src-conn 5, max-src-conn-rate 5/5, overload <childrens> flush
global)
# Pass in http traffic from the internet
pass in quick inet proto tcp to $ext_if port 80 flags S/SA keep state
(max-src-conn 5, max-src-conn-rate 5/5, overload <childrens> flush
global)
# Pass in https traffic from the internet
pass in quick inet proto tcp to $ext_if port 443 flags S/SA keep state
(max-src-conn 5, max-src-conn-rate 5/5, overload <childrens> flush
global)
# Pass in smtp traffic from the internet
pass in quick inet proto tcp to $ext_if port 25 flags S/SA keep state
(max-src-conn 5, max-src-conn-rate 5/5, overload <childrens> flush
global)
# Allow selected icmp types
#pass quick inet proto icmp all icmp-type $icmp_types keep state
#pass quick inet6 proto ipv6-icmp all icmp-type $icmp6_types keep state
# Allow pings out
#pass out inet proto icmp all icmp-type $icmp_types keep state
# and for ipv6
#pass out inet6 proto icmpv6-icmp all icmp-type $icmp6_types keep state
# The above icmp rules aren't working so just allow all of them
pass quick inet proto icmp all icmp-type $icmp_types keep state
pass quick inet6 proto ipv6-icmp all keep state
# For traffic from the ftp proxy
anchor "ftp-proxy/*"
pass out proto tcp from 127.0.0.1 to any port ftp
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAPORhP5gctSpskHiW=_UxgepjrN1R_pm1FiLG57SDpVuwSRS_A>