On 10/28/16 08:55, Mik J wrote:
> I have FTP clients behind my Openbsd firewall and they want to access ftp
> sites on the internet
>
> I have read numerous documentations but haven't found the answer yet.
>
> * I start the ftp-proxy like this
> /usr/sbin/ftp-proxy -D7 -v
>
> * I have rules in my pf.conf
> anchor "ftp-proxy/*"
> pass in quick on $int_if inet proto tcp from $lan to any port 21 divert-to
> 127.0.0.1 port 8021
> pass out quick on $ext_if inet proto tcp from $ext_add to any port 21
I've only ever run the ftp-proxy using the exact rules from the man
page, that is
anchor "ftp-proxy/*"
pass in quick proto tcp to port ftp divert-to 127.0.0.1 port 8021
pass out inet proto tcp from (self) to any port ftp
but there are a couple of things you might want to try.
* Check whether specifying the listening address (the -a option) makes
a difference with your ruleset.
* taking a peek at the gateway closest to me that runs ftp-proxy
I notice that I apparently had reason to use the -r option (check the
man page) but the details of just what triggered this elude me at the
moment.
> * My question
> The ftp data channel connects to an unknown server and an unknown port. I
> don't want to open a large range of ports on my external firewall's interface.
> How can I only allow a specific set of outgoing port when the connection is
> initiated by the ftp-proxy only ?
That's what ftp-proxy is for. It inserts the rules it needs in the
anchor. My hunch is that you're not actually allowing traffic initiated
by the proxy to pass.
- P
--
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.
