PF NAT FTP dir

[chuvy]

Hello.

I can't execute the dir command on external ftp servers from my nat clients. It stays and does nothing. My system: FreeBSD 8.2, GENERIC kernel. Tried it with custom kernel too. On FreeBSD 7.2 these pf rules work fine. In 8.2 they sometimes work, but just at first time after restart of pf i.e. I can dir just one time.

My pf.conf:

ext_if = "bge0"
int_if = "bge1"

ext_addr = "x.y.w.z"
nat_network = "10.0.0.0/24"
table <trusted_hosts> const persist { $host1, $host2 }
set skip on lo0
scrub in all
nat pass on $ext_if from $nat_network to any -> ($ext_if)

block log all
pass from $nat_network to any

pass out on $ext_if from $ext_if to any

pass on $ext_if proto icmp from any to $ext_addr icmp-type echoreq
pass quick from <trusted_hosts> to any

block proto tcp from any to any port ssh

pass in on $int_if all
pass out on $int_if all

I tried just with:

nat pass on $ext_if from $nat_network to any -> ($ext_if)
pass in all
pass out all

And with included statements in rules for pf.

pass proto tcp from any to any port 21 keep state

And much more.
But it works on FreeBSD 7.2. It does not work on 8.2.

Where am I wrong?

 

[SirDice]

This probably explains it: Active FTP vs. Passive FTP, a Definitive Explanation

PF: Issues with FTP

 

[chuvy]

Thanks for reply.

This probably explains it: Active FTP vs. Passive FTP, a Definitive Explanation

PF: Issues with FTP

I have program written on java, but it not work with ftp-proxy. For ftp need just passive mode.
With ipfw_nat all work fine, but historically on server pf.

 

[ecazamir]

Try adding a 'keep state' to this line:

pass from $nat_network to any

 

[chuvy]

Try adding a 'keep state' to this line:
Code:
pass from $nat_network to any

Ok

pass quick from $nat_network to any keep state

Nothing changed.

But "keep state" automatic already have in rules, if look up cmd
# pfctl -sr
all rules with "flags S/SA keep state".

 

[ecazamir]

Well then.. perhaps ftp/ftpproxy may be the answer, used together with a redir rule:

rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021

Adjust to suit your needs.

 

[chuvy]

Well then.. perhaps ftp/ftpproxy may be the answer

I tried with pf ftp-proxy. Does ftp/ftpproxy better?

 

[ecazamir]

I wasn't aware of /etc/rc.d/ftp-proxy and /usr/sbin/ftp-proxy. I think both should work in a similar fashion.

 

[chuvy]

Thanks for all.

Before create new theme, i am found two same themes. One desided by change hardware, another by went to ipfw.
I will try second.

I think the trouble pf with hardware.

I think theme is closed.