[PF] Problem with ftp and ALTQ

[gotian]

Hello,

I have two problems connected with PF on FreeBSD 7.0.
1) I can't connect to ftp servers on router(FreeBSD), but NAT users can. Here is my pf.conf

ext_if="nfe0"
int_if="dc0"
int_net="192.168.6.0/24"
table <firewall> const { self }
set skip on lo
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $int_if proto tcp from $int_net to any port 21 -> 127.0.0.1 port 8021
nat on $ext_if from $int_net to any -> $ext_if

block drop in all
pass in on $int_if from $int_net to any
block out all
anchor "ftp-proxy/*"
pass in proto tcp to <firewall> port { ssh } modulate state
pass in on $int_if proto icmp from $int_net to <firewall> keep state
pass out on $int_if all modulate state
pass out on $ext_if proto { tcp udp } from any to any port { 53 21 20 } modulate state
pass out on $ext_if proto icmp from any to any keep state

ftp session on router:

[root@freebsd ~]# ftp ftp.freebsd.org
Trying 204.152.184.73...
Connected to ftp.freebsd.org.
220 Welcome to freebsd.isc.org.
Name (ftp.freebsd.org:ftp): ftp
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||43044|)
500 Illegal EPRT command.
500 Illegal PORT command.
425 Use PORT or PASV first.

If I put rule: pass out all then everything is OK. But I want to have out traffic default block.

2) I have in NAT 100 computers and I want to give this same bandwidth for each, and I don't want to create 100 rules . In linux is SFQ or WFQ that can do so. Is anything on FreeBSD that is similar??

Thanks for help

[J65nko]

Due to to the way ftp-proxy works, you cannot use ftp on the router itself. Ftp traffic passing through the internal router interface is redirected to ftp-proxy for handling. Ftp connections originated from the router itself go out directly through the external interface, thus bypassing ftp-proxy

If you want to use ftp on the router you could create an anchor and temporarily attach two rules to it

1. pass out tcp traffic originating from the external public address with destination port 21
   
   This rule will handle the ftp command channel
   
   
2. pass out tcp traffic originating from the external public address to any IP address with destination ports >1023
   
   This rule will take care of the ftp data channel connections (for passive ftp)