have anyone configured "synproxy state" beforce

[zhouyi zhou]

Dear Mr. Volker
 Thank you very much
 Zelest persuade me add a "set skip on lo0".
 That becomes:
set skip on lo0
pass in quick on rl0 proto tcp from any to any port=21 flags S/SA synproxy stat\e
Sincerely yours
Zhouyi Zhou
On Tue, 29 May 2007 11:08:02 +0200
Volker <volker at vwsoft.com> wrote:

> On 05/28/07 14:17, Zhouyi Zhou wrote:
> > high everyone,( in pariticular Max :-))
> >  The configuration line in my pf.conf is:
> >  pass in quick on lo0 proto tcp from any to any port 21 flags S/SA synproxy 
> > state
> > 
> >  But:
> >  the connection is established, but the control did not seams to pass to the 
> > ftpd
> > Sincerely yours
> > Zhouyi Zhou 
> 
> Zhouyi,
> 
> security@ is the wrong mailing list. Please post questions like this
> to pf at .
> 
> I'm wondering where this traffic originates? You're using interface
> lo0 which will (most likely) be used for traffic on the local machine
>  but you should not find much traffic on that interface from other hosts.
> 
> As you're using 21/tcp I assume you're playing with ftp traffic. Ftp
> is not just using that single (control) port but a pair of 21/tcp and
> a dynamic allocated port. You have to pass that traffic, too or
> otherwise no data communication will be established. Also it is most
> likely that you will have to use an FTP proxy.
> 
> I suspect your whole problem is really not synproxy related.
> 
> HTH
> 
> Volker
> 
> 
> >  (Sorry for the previouly base64 encode mail caused by M$ outlook)
> PS: FreeBSD is also great for workstations! :)
>