OpenBsd 4.3 PF with Reverse ftp-proxy problem

Eric Papet <[email protected]>
Newsgroups gmane.os.openbsd.pf
Message-ID <[email protected]>
Hi,

I try to safty my ftp-server in DMZ.

      FTP-CLIENT( PASS ON MODE )
          |
          |
        INTERNET
       |        |
ADSL_GW         FIBER_GW
|               |
PPPOE         FIBER LINK
 |                   |
 |---Routeur---|
      |   |
      |   |
     LAN  DMZ----FTP-SERVER

*The reverse ftp-proxy :
proxy    10334  0.0  0.1   340   904 ??  Ss    Tue01PM    0:14.27 
/usr/sbin/ftp-proxy -v -R 192.168.100.249 -p 8022

My rules :*
..............
# FTP-NAT
nat-anchor "ftp-proxy/*"
# RDR-FTP
rdr-anchor "ftp-proxy/*"

#RDR FTP-SERVER
rdr log (all) on $EXT_FIBRE_IF proto tcp from !<RFC1918> to any port ftp 
tag R_PROXY -> 127.0.0.1 port 8022
rdr log (all) on $INT_LAN_IF proto tcp from $LAN_NET to $FIBRE_IP_NAT 
port ftp -> 127.0.0.1 port 8022
rdr pass log (all) on  $INT_DMZ_IF proto tcp from $DMZ_NET to 
$FIBRE_IP_NAT port ftp -> $FTP_SERVER
.......
#FTP RULES
anchor "ftp-proxy/*"
# FTP SERVER
pass in log (all) on $EXT_FIBRE_IF reply-to {($EXT_FIBRE_IF $FIBRE_GW)} 
proto tcp from any to port ftp
pass in log (all) on $EXT_FIBRE_IF reply-to {($EXT_FIBRE_IF $FIBRE_GW)} 
proto tcp from any to 127.0.0.1 port 8022



my Trace :
----------------------------------------
*87.100.21.71 is ftp-client
87.100.21.71 is my ftp-server
**10334 is pid of my reverse ftp-proxy*
*192.168.100.249 is FTP-SERVER*
*192.168.100.254 is router if ip DMZ*

tcpdump in the router:

[root@gw root]# tcpdump -nettt -i pflog0 host client-ftp
tcpdump: listening on pflog0, link-type PFLOG
Mar 10 13:38:07.446193 rule 34/(match) pass in on em1: 
87.100.21.71.51980 > 127.0.0.1.8022: [|tcp] (DF)
Mar 10 13:38:07.446221 rule 1/(match) rdr out on em1: 83.173.67.154.21 > 
87.100.21.71.51980: [|tcp] (DF)
Mar 10 13:38:07.513142 rule 1/(match) rdr in on em1: 87.100.21.71.51980 
 > 127.0.0.1.8022: [|tcp] (DF)
Mar 10 13:38:07.516611 rule 1/(match) rdr out on em1: 83.173.67.154.21 > 
87.100.21.71.51980: [|tcp] (DF)
Mar 10 13:38:07.584099 rule 1/(match) rdr in on em1: 87.100.21.71.51980 
 > 127.0.0.1.8022: [|tcp] (DF)
Mar 10 13:38:11.748531 rule 1/(match) rdr in on em1: 87.100.21.71.51980 
 > 127.0.0.1.8022: [|tcp] (DF)
Mar 10 13:38:11.749418 rule 1/(match) rdr out on em1: 83.173.67.154.21 > 
87.100.21.71.51980: [|tcp] (DF)
Mar 10 13:38:13.247553 rule 1/(match) rdr out on em1: 83.173.67.154.21 > 
87.100.21.71.51980: [|tcp] (DF)
Mar 10 13:38:13.323561 rule 1/(match) rdr in on em1: 87.100.21.71.51980 
 > 127.0.0.1.8022: [|tcp] (DF)
Mar 10 13:38:14.974044 rule 1/(match) rdr in on em1: 87.100.21.71.51980 
 > 127.0.0.1.8022: [|tcp] (DF)
Mar 10 13:38:14.976943 rule 1/(match) rdr out on em1: 83.173.67.154.21 > 
87.100.21.71.51980: [|tcp] (DF)
Mar 10 13:38:15.044000 rule 1/(match) rdr in on em1: 87.100.21.71.51980 
 > 127.0.0.1.8022: [|tcp] (DF)
Mar 10 13:38:15.045999 rule 1/(match) rdr in on em1: 87.100.21.71.51980 
 > 127.0.0.1.8022: [|tcp] (DF)
Mar 10 13:38:15.046506 rule 1/(match) rdr out on em1: 83.173.67.154.21 > 
87.100.21.71.51980: [|tcp] (DF)
Mar 10 13:38:16.537917 rule 1/(match) rdr out on em1: 83.173.67.154.21 > 
87.100.21.71.51980: [|tcp] (DF)
Mar 10 13:38:19.538220 rule 1/(match) rdr out on em1: 83.173.67.154.21 > 
87.100.21.71.51980: [|tcp] (DF)
Mar 10 13:38:19.601190 rule 1/(match) rdr in on em1: 87.100.21.71.51980 
 > 127.0.0.1.8022: [|tcp] (DF)
Mar 10 13:38:20.313752 rule 1/(match) rdr in on em1: 87.100.21.71.51980 
 > 127.0.0.1.8022: [|tcp] (DF)
Mar 10 13:38:20.314627 rule 1/(match) rdr out on em1: 83.173.67.154.21 > 
87.100.21.71.51980: [|tcp] (DF)
Mar 10 13:38:20.379712 rule 1/(match) rdr in on em1: 87.100.21.71.51980 
 > 127.0.0.1.8022: [|tcp] (DF)
Mar 10 13:38:20.381231 rule 29.*10334*.8834.0/(match) pass in on em1: 
87.100.21.71.63387 > 192.168.100.249.*32669:* [|tcp] (DF)  (---> is 
passive socket tp-server listen)
Mar 10 13:38:41.379298 rule 29.10334.8834.0/(match) pass in on em1: 
87.100.21.71.63387 > 192.168.100.249.32669: [|tcp] (DF)
Mar 10 13:39:05.393980 rule 29.10334.8834.0/(match) pass in on em1: 
87.100.21.71.63387 > 192.168.100.249.32669: [|tcp] (DF)
Mar 10 13:39:53.390413 rule 29.10334.8834.0/(match) pass in on em1: 
87.100.21.71.53744 > 192.168.100.249.32669: [|tcp] (DF)
---------------------------------------------------------------------------------------------------------------------------------
tcpdump: listening on pflog0, link-type PFLOG
Mar 10 13:38:07.513262 rule 1/(match) pass out on em2: 
192.168.100.254.4267 > 192.168.100.249.21: [|tcp] (DF)
Mar 10 13:38:20.381226 rule 29.10334.8834.0/(match) pass in on em1: 
87.100.21.71.63387 > 192.168.100.249.32669: [|tcp] (DF)
Mar 10 13:38:20.381246 rule 29.10334.8834.1/(match) pass out on em2: 
192.168.100.254.53499 > 192.168.100.249.32669: [|tcp] (DF)
Mar 10 13:38:29.380587 rule 0/(match) block in on em2: 
192.168.100.249.32669 > 192.168.100.254.53499: [|tcp] (DF)
Mar 10 13:38:41.379293 rule 29.10334.8834.0/(match) pass in on em1: 
87.100.21.71.63387 > 192.168.100.249.32669: [|tcp] (DF)
Mar 10 13:38:41.379324 rule 29.10334.8834.1/(match) pass out on em2: 
192.168.100.254.53479 > 192.168.100.249.32669: [|tcp] (DF)
Mar 10 13:38:41.381690 rule 0/(match) block in on em2: 
192.168.100.249.32669 > 192.168.100.254.53499: [|tcp] (DF)
Mar 10 13:38:50.382515 rule 0/(match) block in on em2: 
192.168.100.249.32669 > 192.168.100.254.53479: [|tcp] (DF)
Mar 10 13:39:02.583626 rule 0/(match) block in on em2: 
192.168.100.249.32669 > 192.168.100.254.53479: [|tcp] (DF)
Mar 10 13:39:05.393974 rule 29.10334.8834.0/(match) pass in on em1: 
87.100.21.71.63387 > 192.168.100.249.32669: [|tcp] (DF)
Mar 10 13:39:05.394004 rule 29.10334.8834.1/(match) pass out on em2: 
192.168.100.254.61147 > 192.168.100.249.32669: [|tcp] (DF)
Mar 10 13:39:05.583777 rule 0/(match) block in on em2: 
192.168.100.249.32669 > 192.168.100.254.53499: [|tcp] (DF)
Mar 10 13:39:25.821468 rule 1/(match) pass out on em2: 
192.168.100.254.34665 > 192.168.100.249.21: [|tcp] (DF)
Mar 10 13:39:25.824769 rule 31/(match) pass in on em2: 
192.168.100.249.34681 > 192.168.100.254.113: [|tcp] (DF)
Mar 10 13:39:25.824793 rule 31/(match) pass out on em2: 
192.168.100.254.113 > 192.168.100.249.34681: [|tcp] (DF)
Mar 10 13:39:26.585710 rule 0/(match) block in on em2: 
192.168.100.249.32669 > 192.168.100.254.53479: [|tcp] (DF)
Mar 10 13:39:26.616392 rule 29.10334.8835.0/(match) pass in on em1: 
91.121.20.186.34974 > 192.168.100.249.31890: [|tcp] (DF)
Mar 10 13:39:26.616418 rule 29.10334.8835.1/(match) pass out on em2: 
192.168.100.254.61126 > 192.168.100.249.31890: [|tcp] (DF)
Mar 10 13:39:27.616277 rule 29.10334.8835.0/(match) pass in on em1: 
91.121.20.186.44023 > 192.168.100.249.33135: [|tcp] (DF)
Mar 10 13:39:27.616322 rule 29.10334.8835.1/(match) pass out on em2: 
192.168.100.254.63099 > 192.168.100.249.33135: [|tcp] (DF)
Mar 10 13:39:51.983984 rule 0/(match) block in on em2: 
192.168.100.249.*32669 *> 192.168.100.254.61147: [|tcp] (DF)
Mar 10 13:39:53.390407 rule 29.10334.8834.0/(match) pass in on em1: 
87.100.21.71.53744 > 192.168.100.249.32669: [|tcp] (DF)
Mar 10 13:39:53.390438 rule 29.10334.8834.1/(match) pass out on em2: 
192.168.100.254.62878 > 192.168.100.249.32669: [|tcp] (DF)
*Mar 10 13:39:53.784197 rule 0/(match) block in on em2: 
192.168.100.249.32669 > 192.168.100.254.53499: [|tcp] (DF)*

-----------------------------------------

I my ftp client, the authentification by port 21 is OK
But when i try to execute DIRcommand  in my ftp-client (pass on mode), 
is not OK.
Why in em2 (DMZ_IF), the rule 0 (block all) block the return ftp-server 
DATA.
 
An other problem when i try to perform ftp-client in other server the 
route in asymetric (fiber, pppoe0)

Excuse me for my bad english, but i'am french.

Thank for your Help.

Eric
 best  regards


--
e.papet.vcf (text/x-vcard, 404 B)
begin:vcard
fn:Eric  Papet
n:Papet;Eric 
org:Co-Fondateur SSII DEV1.0;Lead auditor 27001
adr:Batiment 1. Entreprise;;Technopole Izarbel;Bidart;;64210;France
email;internet:[email protected]
title;quoted-printable:Architecte logiciels & s=C3=A9curit=C3=A9 
tel;work:0559239388
tel;cell:0623537959
note;quoted-printable:Certifi=C3=A9 LeadAuditor ISO 27001
url:http://www.dev1-0.com
version:2.1
end:vcard
smime.p7s (application/x-pkcs7-signature, 4 KB) - not displayed
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.