Hello,
I'm trying to get ftp working from my lan to the internet. I'm using a
deny by default policy and only allowing out specific traffic. My rules are
below. I start pftpx and load the pf.conf file, all is good, until i try to
ftp. Going from the gateway box ftp can at least log on to the site and does
a 200EPRT command which eventually times out, anything behind the gateway
doesn't even get that far. I log everything via pflog and i do not see any
ftp or pftpx output in the logs at all. In /var/log/messages i do see this:
Sep 19 22:36:07 guardian kernel: pflog0: promiscuous mode enabled
Sep 19 22:36:55 guardian pftpx[630]: #3 pf operation failed: Invalid
argument
Sep 19 22:36:55 guardian pftpx[630]: #3 pf rule removal failed: Invalid
argument
Sep 19 22:39:55 guardian pftpx[630]: #4 pf operation failed: Invalid
argument
Sep 19 22:39:55 guardian pftpx[630]: #4 pf rule removal failed: Invalid
argument
Any help appreciated, i'd really like to get this going.
Thanks.
Dave.
# pf.conf
# for use on gateway box
# Required order: options, normalization, queueing, translation, filtering.
# Macros and tables may be defined and used anywhere.
# Note that translation rules are first match while filter rules are last
match.
# macros
# define the two network interfaces
ext_if="xl0"
int_if="xl1"
# define our networks
lan_net="192.168.7.0/24"
# define servers
lan_server="192.168.7.3"
nameservers = "{ xxx }"
isp_dhcp_server = "xxx"
# define services
int_to_lan_services = "{ ssh, smtp, www, pop3, https, pop3s, 8000 }"
lan_to_int_services = "{ ftp-data, ftp, ssh, smtp, 43, domain, http, pop3,
nntp, imap, https, imaps, pop3s, 1790, 1791, 1792, 1793, 1794, 1795, 2401,
4000, 5000, 5001, 5190, cvsup, 6112, 6667, 8000, 8080, 8505, 8880, 9102 }"
# options
set optimization normal
set block-policy return
set require-order yes
set fingerprints "/etc/pf.os"
# This helps protect against my maximum states being reached
# when being port scanned.
set timeout tcp.closed 1
set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 10000, frags 5000 }
# normalize packets to prevent fragmentation attacks
scrub on $ext_if all random-id reassemble tcp
scrub on $int_if inet no-df
# nat
# translate lan client addresses to that of the externalinterface
nat on $ext_if from $int_if:network to any -> ($ext_if)
nat-anchor "pftpx/*"
# redirections
rdr on $ext_if proto tcp from any to any port $int_to_lan_services ->
$lan_server
# pftpx ftp proxy
rdr-anchor "pftpx/*"
rdr pass on $int_if proto tcp from $int_if:network to any port 21 ->
127.0.0.1 port 8021
# default deny
block log all
# immediately prevent IPv6 traffic from entering or leaving all interfaces
block quick inet6 all
# pass loopback traffic
pass quick on lo0 all
# pftpx proxy traffic
anchor "pftpx /*"
# antispoof options
antispoof quick for $ext_if inet
antispoof quick for $int_if inet
# External interface (Incoming)
# Allow dhcp in
pass in quick on $ext_if inet proto udp from $isp_dhcp_server port bootps to
255.255.255.255 port bootpc
# Allow internet requests through in order to contact lan server
# keep state on this connection
pass in quick on $ext_if inet proto tcp from any to $lan_server port
$int_to_lan_services flags S/SA keep state
pass in quick on $ext_if inet proto udp from any to $lan_server port 1194
keep state
# External interface (outgoing)
# allow dhcp out
pass out quick on $ext_if inet proto udp from $ext_if to any port bootps
# allow UDP requests to port 53 from firewall to exit ext_if
# in order to contact internet nameservers (keep state on this connection)
pass out quick on $ext_if inet proto udp from $ext_if to $nameservers port
53 keep state
# allow UDP requests to port 123 from firewall to exit ext_if
# in order to contact internet ntp servers
# (keep state on this connection)
pass out quick on $ext_if inet proto udp from $ext_if to any port 123 keep
state
# Allow traffic from lan clients to exit $ext_if
# (After natting is performed) in order to contact internet servers
# (Keep state on this connection)
pass out quick on $ext_if inet proto tcp from $ext_if to any port
$lan_to_int_services flags S/SA keep state
# allow out the default range for traceroute(8):
# "base+nhops*nqueries-1" (33434+64*3-1)
pass out quick on $ext_if inet proto udp from any to any \
port 33433 >< 33626 keep state
# Internal interface (incoming)
# allow lan broadcasts
pass in quick on $int_if proto { tcp, udp } from $lan_net to
$int_if:broadcast
# allow UDP requests to port 53 from lan clients to enter LAN
# in order to perform dns queries on the firewall
# (keep state on this connection)
pass in quick on $int_if inet proto udp from $lan_net to $int_if port 53
keep state
# allow UDP requests to ports 67, 68, and 123 from lan clients to enter lan
# in order to perform dhcp and ntp queries on the firewall
# ( Keep state on this connection)
pass in quick on $int_if inet proto udp from $lan_net to $int_if port { 67,
68, 123, 6112 } keep state
# allow lan traffic from lan clients to enter lan
# in order to contact internet servers (keep state on this connection)
pass in quick on $int_if inet proto tcp from $lan_net to any port
$lan_to_int_services flags S/SA keep state
# allow requests from lan admin to enter LAN
# in order to ping/traceroute any system (firewall, dmz server, and internet
hosts)
pass in quick on $int_if inet proto icmp from $lan_net to any icmp-type 8
keep state
# Internal interface (Outgoing)
# Allow internet requests to exit lan
# in order to contact internet servers
pass out quick on $int_if inet proto tcp from any to $lan_server port
$int_to_lan_services keep state
# Firewall connects to the lan server via scp/ssh for backup purposes
pass out quick on $int_if inet proto tcp from $int_if to $lan_server port 22
flags S/SA keep state
# firewall connects back to the storage daemon
# on the lan server port 9103 to enable it to back up
pass out quick on $int_if inet proto tcp from $int_if to $lan_server port
{ 9101, 9102, 9103 } flags S/SA keep state
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
