ipfilter/ipnat problem with FTP proxy

Matt Pounsett matt at conundrum.com
Sat Sep 3 17:25:46 PDT 2005


I'm trying to get the ipfilter/ipnat FTP proxy working, and clearly  
I'm missing something.  The symptom I have is that I'm getting a No  
Route To Host error when a remote FTP server attempts to open a data  
channel back to my clients (fetch, wget, etc. report No Route To Hose  
immediately upon trying to FTP down a file, while interactive clients  
such as ftp and ncftp allow me to login, but report the error as soon  
as I try to do anything other than change directories.. e.g. ls, get,  
mget, etc.).  I have the same problem whether I attempt to FTP from  
my firewall directly, or from any of the machines on the inside network.

I'm using user-ppp to create a pppoe connection over a DSL link (the  
DSL connection is a statically addressed point-to-point network), and  
have a publicly routable network on the inside side of my firewall.   
I do not normally want to do NAT, but from what I've read at http:// 
www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls- 
ipf.html, it appears that I have to in order to get the FTP proxy  
working, so I'm attempting only to NAT outbound FTP connections.

Relevant config info is as follows:
-----
/etc/rc.conf
-----
ipfilter_enable="YES"
ipnat_enable="YES"
ipmon_enable="YES"

-----
/etc/ipf.rules
-----
pass out quick on tun0 proto tcp from any to any port = 21 flags S  
keep state

-----
/etc/ipnat.rules  (I've anonymized the /29 interior network in this  
email)
-----
map tun0 192.0.2.80/29 -> 0/32 proxy port 21 ftp/tcp
map tun0 0/32 -> 0/32 proxy port 21 ftp/tcp

-----

Does anyone see anything clearly wrong in the above?  As far as I can  
tell, it's a perfect copy of the examples from the handbook, with the  
obvious logical changes such as interface names and network addresses.

Thanks very much in advance.
    Matt Pounsett
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20050903/a7a6af89/PGP.bin


More information about the freebsd-questions mailing list