[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: God, do I hate to ask another FTP question. *** SOLUTION ***
Once again thanks for the help, As I indicated last night I have solved
the problem. I will explain the problem again and its solution below
THE ORIGINAL PROBLEM:
here is the network diagram
Linux BSD Gate BSD Gate HP/UX
After upgrading to 3.0 and creating new pf.conf and nat.conf files. We
verified that we could telnet, cvs, and such. So the VPN works
However neither of the backend nodes (192.168.X.0/24) could FTP to Internet
boxes. They could ftp to other node's backends (i.e. FTP from 192.168.35.2
I fixed this by adding the proper ftp-proxy entries as per the man page.
Voila, now we could FTP to the Internet again.
Problem was that this broke the backend node connection for FTP.
(Again, FTP from 192.168.35.2 to 192.168.30.17)
The reason was that now FTP traffic, instead of being directed through
ipsec was always proxied out to the outside interface and sent out on the wire.
since it wasn't sent through the VPN pipe, 192.168.0.0/16 traffic had
nowhere to go. Of course this is what we wanted for Internet traffic in
It almost seems trivial now (doesn't it always)
by changing the entry in nat.conf from
rdr on de1 from any to any port 21 -> 127.0.0.1 port 8081
rdr on de1 from any to !192.168.0.0/16 port 21 -> 127.0.0.1 port 8081
This allows 192.168.0.0/16 to travel along through the VPN and all other to
The interesting thing about the solution is that if I do a "pfctl -sn" I get
@rdr on de1 from any to 192.168.0.0/16 port 21 -> 127.0.0.1 port 8081
@rdr on de1 from any to !4
192.168.0.0/16 port 21 -> 127.0.0.1 port 8081
Notice the "!" in the second one.
#1 A comment should be added to the ipsec man (or somewhere appropriate
that someone setting a VPN would notice it)
#2 A minor change to the pfctl code should be made so that "pfctl -sn"
indicates the "!" correctly.
#3 I better get this solution implemented system wide before someone
notices it doesn't currently work
Senior Network Engineer