Do you have 'pass on lo0 keep state' ? Forwarding enabled?
yep forwarding enabled, these are the first rules I have following my NAT/RDR rules:
# block everything by default block return-rst in log proto tcp from any to any block in log from any to any
# block in spoofs
# log these in case we want to analyze an attack
block in log quick on {xl0,xl1} from $spoof_ips to any
block in log quick on xl0 from any to $frsmurf_ips
block in log quick on xl1 from any to $t1smurf_ips# the local interface is wide open pass in quick on lo0 all pass out quick on lo0 all
# no ip6 pls... block in quick inet6 all block out quick inet6 all
#....
I did comment out the spoof blocking lines above (one of the spoof IP's in the list is 127.0.0.0/8), and it did not make a difference.
What does 'tcpdump -i pflog0 -env' say when you start an FTP session?
# tcpdump -env -i lo0 tcpdump: listening on lo0
# ifconfig lo0
lo0: flags=8149<UP,LOOPBACK,RUNNING,PROMISC,MULTICAST> mtu 33224
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x7
James Cammarata [EMAIL PROTECTED] www.sngx.net home: 314-835-1122 work: 314-872-2426 cell: 314-409-0583 ______________________________________________________________ Out the Ethernet, through the router, down the fiber, off another router, down the T1, past the fire-wall ...nothing but Net
