pf + jail question.

C. C. Tang hiyorin at
Tue Jan 19 10:05:50 UTC 2010

Hi all,

May be this question is better to post on -pf or -jail but I really 
don't know where the problem is. So post here first.

I have a FreeBSD-8.0-RELEASE-p2 box with two NICs acting as gateway 
using pf (with ftp-proxy enabled) in my home network configured as follow:

LAN: ( + tap0 for VPN)
WAN: IP obtained from ISP.

When I played with jail, I found that fp didn't block the traffic that 
it should.
For example,
I have the following line in pf.conf:
block quick proto tcp from any to any port 21

Then in the host(gateway):
[host] ~> ftp
ftp: connect: Operation not permitted

In the jail:
[jail1] ~> ftp
Connected to
...(welcome message)

Other client on the LAN(Windows):
Connected to
Connection closed by remote host.

The ftp-proxy log when windows client is connecting:
#5 accepted connection from
#5 proxy cannot connect to server Operation not permitted
#5 ending session

My jail's IP which is within the subnet of LAN.

Do anyone know where the problem is?
It seems that the traffic from jail bypasses the pf filtering rules?

The following is part of my pf.conf:
int_if="{ lan0 }"
internal_net="{, }"

scrub in
nat pass on $ext_if from $internal_net to any -> ($ext_if) static-port

# handling FTP
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

no rdr on $int_if proto tcp from $internal_net to $self port 21
rdr pass on $int_if proto tcp from $internal_net to any port 21 -> \ port 8021

anchor "ftp-proxy/*"
block quick proto tcp from any to any port 21


More information about the freebsd-questions mailing list