Форум системных администраторов

фтп чей? логи фаера в студию!

Как я понял это pf.conf или другое нужно.
FTP. Наш. он стоит на хостинге.


ext_if="rl0"
int_if="vr0"
lan="192.168.0.0/24"
ext_addr="212.112.x.x"
int_addr="192.168.0.1"
adm_host="{x.x.x.x.x.x.x.}"
ispdns="{ 212.112.96.1, 213.145.129.20 }"
tcpports="{ 25, 110, 995, 80, 443, 53, 22, 21, 5190 }"
table <nonroute> { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 204.152,64.0/23, 224.0.0.0/3, 20.20.
table <office> persist file "/usr/local/etc/squid/office.acl"
table <office_lim> persist file "/usr/local/etc/squid/office_lim.acl"
table <kg_zone> persist file "/usr/local/etc/squid/kg.acl"
table <mra> persist file "/usr/local/etc/squid/mra.acl"
mra_ports="{ 5190, 443,2041,2042 }"
#set block-policy drop
#set loginterface $ext_if
#scrub in all fragment reassemble
# Nat
nat-anchor "ftp-proxy/*"
nat on $ext_if from <office_lim> to <kg_zone> -> $ext_addr
nat on $ext_if from <office> to any -> $ext_addr
rdr proto tcp from <office> to !$lan port {80,8080,3128} -> 192.168.0.1 port 3128
#rdr on $ext_if proto tcp from $adm_host to $ext_addr port 3389 tag RADM -> 192.168.0.2
#pass in quick on $ext_if proto tcp from $adm_host to $ext_addr port=3389 tagged RADM flags S/SA synproxy state
rdr pass on $int_if proto tcp from $lan to any port 21 -> 127.0.0.1 port 8021
rdr-anchor "ftp-proxy/*"
# Deny port scanners for OS detecting
block in quick proto tcp from any to $ext_addr flags SF/SFRA
#block in quick proto tcp from any to $ext_addr flags SFUP/SFRAU
block in quick proto tcp from any to $ext_addr flags FPU/SFRAUP
block in quick proto tcp from any to $ext_addr flags F/SFRA
block in quick proto tcp from any to $ext_addr flags U/SFRAU
block in quick proto tcp from any to $ext_addr flags P/P
# Allow Active FTP
pass in quick proto tcp from any port=20 to any keep state
###pass in quick proto tcp from any port=21 to any keep state
# Deny nonroute ips
block in quick on $ext_if from <nonroute> to $ext_addr
block out quick on $ext_if from any to <nonroute>
# Deny ports
block in quick on $ext_if proto udp from any to $ext_addr/32 port=514
block in quick on $ext_if proto tcp from any to $ext_addr/32 port 135><140
block in quick on $ext_if proto udp from any to $ext_addr/32 port 135><140
block in quick on $ext_if proto tcp from any to $ext_addr/32 port=901
block in quick on $ext_if proto tcp from any to $ext_addr/32 port=587
block in quick on $ext_if proto tcp from any to $ext_addr/32 port=3306
block in quick on $ext_if proto tcp from any to $ext_addr/32 port=67
block in quick on $ext_if proto udp from any to $ext_addr/32 port=67
block in quick on $ext_if proto udp from any to $ext_addr/32 port=161
block in quick on $ext_if proto tcp from any to $ext_addr/32 port=953
#block in quick on $ext_if proto tcp from any to $ext_addr/32 port=445
block in quick on $ext_if proto tcp from any to $ext_addr/32 port=5432
block in quick on $ext_if proto tcp from any to $ext_addr/32 port=161
block in quick on $ext_if proto udp from any to $ext_addr/32 port=161
block in quick on $int_if proto tcp from any to $int_addr/32 port=161
block in quick on $int_if proto udp from any to $int_addr/32 port=161
block in quick on $ext_if proto tcp from any to $ext_addr/32 port=3128
#Block bad clients
block out quick on $int_if proto tcp from $lan to <mra> port $mra_ports
#block out quick on $int_if proto tcp from $lan to <kg_zone> port 6881
#block out quick on $int_if proto tcp from $lan port 6881 to <kg_zone>
# Block office_limit
pass quick on $int_if from <office_lim> to <kg_zone> keep state
pass quick on $int_if from $lan to $lan keep state
block quick on $int_if from <office_lim> to !<kg_zone>
block quick on $int_if from !<kg_zone> to <office>
# Allow services
pass in quick on $ext_if proto tcp from $adm_host to $ext_addr/32 port=80 flags S/SA keep state
pass in quick on $ext_if proto tcp from $adm_host to $ext_addr/32 port=22 keep state
pass in quick on $ext_if proto tcp from any to $ext_addr/32 port=2223 keep state
# Allow loopback
pass quick on lo0 all
# Allow ICMP
pass quick proto icmp
#pass in quick proto icmp from any to $ext_addr icmp-type echoreq
#pass in quick proto icmp from any to $ext_addr icmp-type echorep
#pass out quick proto icmp from any to $ext_addr icmp-type echoreq
#pass out quick proto icmp from any to $ext_addr icmp-type echorep
# DNS
pass out quick on $ext_if proto tcp from $ext_addr to $ispdns port=53 keep state
pass out quick on $ext_if proto udp from $ext_addr to $ispdns port=53 keep state
pass out quick on $ext_if proto tcp from $ext_addr to any port=7777 keep state
# Allow office_new
pass out quick on $int_if proto tcp from <office> to <kg_zone> keep state
pass out quick on $int_if proto udp from <office> to <kg_zone> keep state
pass out quick on $int_if proto tcp from <office> to any port $tcpports keep state
pass out quick on $int_if proto udp from <office> to any port 53 keep state
# Allow office
pass out quick on $ext_if proto tcp from $ext_addr to any keep state
pass out quick on $int_if proto tcp from <office> to any keep state
pass out quick on $ext_if proto udp from $ext_addr to any keep state
pass out quick on $int_if proto udp from <office> to any keep state
# Deny all
block in quick on $ext_if proto tcp from any to $ext_addr flags S/SAFRP
block in quick on $ext_if proto udp from any to $ext_addr

у мну тоже самое было.
хмм... не помню точно но там одну строчку добавляешь порт https что ли и все ОК.
в роде одна из этих строчек если честно не помню

${IPFW} add allow all from any to any 5190 via ${EXT}
${IPFW} add allow all from any 5190 to any via ${EXT}
${IPFW} add pass tcp from any to any 443 out

помню что 5190 это для месенджнров типа qip, icq и т.д. а вот 443 не наю гы гы

zaka
Это в ipfw, у чела же на pf настроено.

Сдается мне там банально фаер рубит подключения к нестандартному порту пассивного режима.

cliff, погугли на предмет ftp-proxy - во FreeBSD это все довольно просто настраивается.

Raven писал(а):zaka
Это в ipfw, у чела же на pf настроено.

Сдается мне там банально фаер рубит подключения к нестандартному порту пассивного режима.

упсс я не заметил . Смотрю проблемс у чела вспомнил про себя как я мучился с https и написал

Всем спосибо исправил! Заменил сквид конф на начальную и все заработала.