redirect outbound packets originating from localhost to locally assign address (-> ftp-proxy)

Article View: bit.listserv.openbsd-pf

Article #162

Back to bit.listserv.openbsd-pf Previous Next

#162

From: twies
Date: Thu, 17 Jan 2013 07:33

29 lines
2444 bytes

Hello,

i'm new on this list, so please be patient with me. 
Anyway - I did my homework (at least i think so) but i'm stuck 
nevertheless. All man pages and docs i found seem to indicate that
what i want is impossible, but i hope, someone might have an idea...

I want to use ftp-proxy for outgoing client-requests. The main reason
for that is the automatic handling of pf rules that allow traffic
on the data connection without opening up the firewall to any ip/port 
for outbound traffic.

I'm unsing OpenBSD 5.0. I know, the ftp-proxy is purely transparent 
and is invoked by a divert-to rule. But

- divert-to is only allowed on inbound rules

- rdr-to is not supported on outbound rules, if the destination is
  a locally assigned address

So how can i get packets to port 21 that originate from the host 
itself processed by the ftp-proxy.

Background: I'm using squid on this host and i want it to serve 
ftp:// URLs via http. This usage doesnt seem to be unusual and
there might be a solution i didn't think of/find...

Thanks in advance
Thomas

Technical Details

Message-ID: <1358355901.90395.YahooMailClassic@web160904.mail.bf1.yahoo.com>

Path:

arc1-ca.pugleaf.net!o9ni8438wio.1!nntp.google.com!feeder1.cambriumusenet.nl!feed.tweaknews.nl!94.232.116.12.MISMATCH!feed.xsnews.nl!border-2.ams.xsnews.nl!border4.nntp.ams.giganews.com!border2.nntp.ams.giganews.com!border3.nntp.ams.giganews.com!border1.nntp.ams.giganews.com!nntp.giganews.com!newsfeed.straub-nv.de!feeder.erje.net!us.feeder.erje.net!feed.news.qwest.net!mpls-nntp-02.inet.qwest.net!nx01.iad01.newshosting.com!newshosting.com!69.16.185.21.MISMATCH!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn

Show Full Headers

Complete Article Headers

X-Google-Thread: bffa70e3,24451b58c3ddccc9,start
X-Google-Attributes: gidbffa70e3,public,usenet
X-Google-NewGroupId: yes
X-Google-Language: ENGLISH,ASCII-7-bit
X-Received: by 10.180.83.101 with SMTP id p5mr1733741wiy.0.1358655728155;
        Sat, 19 Jan 2013 20:22:08 -0800 (PST)
Path: arc1-ca.pugleaf.net!o9ni8438wio.1!nntp.google.com!feeder1.cambriumusenet.nl!feed.tweaknews.nl!94.232.116.12.MISMATCH!feed.xsnews.nl!border-2.ams.xsnews.nl!border4.nntp.ams.giganews.com!border2.nntp.ams.giganews.com!border3.nntp.ams.giganews.com!border1.nntp.ams.giganews.com!nntp.giganews.com!newsfeed.straub-nv.de!feeder.erje.net!us.feeder.erje.net!feed.news.qwest.net!mpls-nntp-02.inet.qwest.net!nx01.iad01.newshosting.com!newshosting.com!69.16.185.21.MISMATCH!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn
From: twies@yahoo.com
Newsgroups: bit.listserv.openbsd-pf
Subject: redirect outbound packets originating from localhost to locally assign address (-> ftp-proxy)
Date: 16 Jan 2013 23:33:21 -0800
Organization: None
Lines: 29
Message-ID: <1358355901.90395.YahooMailClassic@web160904.mail.bf1.yahoo.com>
NNTP-Posting-Host: [193.158.246.178]
Mime-Version: 1.0
NNTP-Posting-Date: 17 Jan 2013 07:33:22 GMT
X-Received-Bytes: 1650
Bytes: 1974
Content-Type: text/plain; charset=us-ascii