FTP ruleset questions

[hitete]

Hi,

I've having difficulties with my FTP ruleset.

I'm using the FTP-PROXY on openbsd for CLIENT ftp access from my LAN to INTERNET.
transparent rdr to port 8021 on localhost for all adresses on the LAN.

I want to add rules in order for my new FTP server to be accessed via Internet.

How can I do that ?.


Thanks

[jggimi]

Without more information, any answer is a guess. We aren't mind readers.

Let us pretend that you wish to use an FTP server on your local LAN, and currently have the following configuration:

/etc/pf.conf:

.
.
.
nat-anchor "ftp-proxy/*"
.
.
.
rdr-anchor "ftp-proxy/*"
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1  port 8021 
.
.
anchor "ftp-proxy/*"
.
.

/etc/rc.conf.local:

.
.
.
ftpproxy_flags=""
.
.

The easiest way to add an FTP server on the local network is to add a second instance of ftp-proxy, using a different port number.

You cannot add a second instance through /etc/rc.conf or /etc/rc.conf.local, as these just set variables for /etc/rc. Add the second instance in /etc/rc.local, instead.

Your first instance (set up via /etc/rc.conf.local) listens, by default, to the loopback interface port 8021.

The instance you script in /etc/rc.local will listen on port 21, and route the output to the appropriate FTP server on your LAN.

Here's an example (in /etc/rc.local) that listens on an external interface on the 192 network and routes traffic to the server on the 10 network:

.
.
.
ftp-proxy -R 10.10.10.1 -p 21 -b 192.168.0.1
.
.

I leave the pf.conf changes to you.

[hitete]

OK that's very clear.
No problem for the rules, I'll take car of them.
Thanks loads !
I'll let you know once all taken care of.

Best regards.