I would try something like so:
/etc/inetd.conf
The ftp-proxy service is run from inetd, so you will need to add this service to the
inetd configuration file and make sure that inetd is not disabled in /etc/rc.conf.
Your entry should look like the following sample, adjusted for your site:
ftp-proxy stream tcp nowait root /usr/libexec/ftp-proxy \
ftp-proxy -n -V -D3 -u nobody -m 55000 -M 57000 -t 300
The options on ftp-proxy are as follows:
-n Enable ftp-proxy to work with NAT translation
-V Verbose mode for logging to syslogd. Remove this once you are .
-D3 Debug level 0-3 in increasing verbosity This switch can also be removed once
you have ftp-proxy operating satisfactorily.
-u userid The userid that ftp-proxy runs as. The default is "proxy" but the
"proxy" user may not be in your account database, so I used "nobody"
-m Minimum port in your reserved ports range
-M Maximum port in your reserved ports range
-t Timeout in seconds. Default is no timeout
/etc/pf.conf
Create a Macro like so (also one for $ExtIF):
FTPPORTS = "{ 55000 >< 57000 }" (in this example, 55000 is -m and 57000 is -M)
This one is pretty straight forward, you just need to redirect outbound FTP traffic to
use the ftp-proxy.
rdr on ep1 proto tcp from any to any port 21 -> 127.0.0.1 port 8081
pass in quick on $ExtIF inet proto tcp from any port 20 to \
$ExtIF port $FTPPORTS flags S/SA keep state (passive FTP)
The internal interface in this example is ep1, but yours is probably different.
Hope it helps,
Richard
