On Friday 03 October 2008 11:11:57 Redd Vinylene wrote:
> Greetings ladies and gentlemen!
>
> Why does the below pf.conf (run from box1) give me
> "getpeername(control_sock): Transport endpoint is not connected,
> Socket error (Connection refused) - reconnecting" when trying to log
> onto box3 via passive FTP? Active FTP gives me "425 Can't build data
> connection: Connection refused." (box2 and box3 are jails running off
> box1)
See ftp-proxy(8).
Note that active works with the ruleset you provided (due to the "pass out
keep state"-rule), but there is obviously a firewall problem on the client
preventing that.
> -
>
> [EMAIL PROTECTED] cat /etc/pf.conf
>
> box1 = "80.203.2.2"
>
> box2 = "80.203.2.3"
>
> box3 = "{ 80.203.2.4 [...] 80.203.2.127 }"
>
> ext_if = "rl0"
>
> set block-policy return
>
> set skip on { lo0 }
>
> scrub in
>
> pass out keep state
>
> block in
>
> pass in on $ext_if inet proto tcp from any to any port { 22 } keep state
>
> pass in on $ext_if inet proto tcp from any to $box2 port { 25, 53, 80,
> 110 } keep state
>
> pass in on $ext_if inet proto udp from any to $box2 port 53 keep state
>
> pass in on $ext_if inet proto tcp from any to $box3 port { 20, 21, 113
> } keep state
>
> pass in on $ext_if inet proto icmp from any to any keep state
>
> -
>
> [EMAIL PROTECTED] cat /etc/inetd.conf
>
> ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
>
> -
>
> I hope I've been verbose enough. Thank you!
--
/"\ Best regards, | [EMAIL PROTECTED]
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | [EMAIL PROTECTED]
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
_______________________________________________
freebsd-jail@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-jail
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
