openBSD router mit Firewall macht Probleme mit FTP

[kolvar]

Moin moin,

Ausgangsbasis:
- ein openBSD-Router mit PF für 4 subnetze (den wer anderes eingerichtet hat)
- Online-Linux-Server bei einem Provider auf den mit FTP zugegriffen werden soll.

Dieser Zugriff hat bisher geklappt. Seitdem sie jedoch ein Kernel-Update durchgeführt haben geht es von allen Netzen hinter dem openBSD router nicht mehr, wohl aber aus anderen Netzen.
Da ich jetzt wohl gezwungen bin, zu vermuten (bwz. der Provider nicht bereit ist, herauszufinden, warum es bei dem vorherigen Kernel funktionierte), dass es an PF liegt, ich aber keine Ahnung von dieser Firewall habe (bzw. ich nach der ersten Lektüre von online-tutorials zu feige bin, an einem Live-System rumzumurksen)
Hier die derzeige Konfiguration.

ext_if="ep0"
int_if1="rl0"
int_if2="rl1"
int_if3="rl2"
int_if4="rl3"
int_net1="192.168.1.0/24"
int_net2="192.168.2.0/24"
int_net3="192.168.3.0/24"
int_net4="192.168.4.0/24"

scrub in all

nat on $ext_if from 192.168.1.0/24 to ! $int_if1 -> ($ext_if)
nat on $ext_if from 192.168.2.0/24 to ! $int_if2 -> ($ext_if)
nat on $ext_if from 192.168.3.0/24 to ! $int_if3 -> ($ext_if)
nat on $ext_if from 192.168.4.0/24 to ! $int_if4 -> ($ext_if)

nat-anchor "authpf/*"

rdr pass on $int_if1 proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $int_if2 proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $int_if3 proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $int_if4 proto tcp to port ftp -> 127.0.0.1 port 8021


rdr on $ext_if proto tcp from any to any port 2323 -> 192.168.2.150 port 22
rdr on $ext_if proto tcp from any to any port 2324 -> 192.168.2.4 port 22
#block in log all

block in from $int_net1 to $int_net2
block in from $int_net1 to $int_net3
block in from $int_net1 to $int_net4

block in from $int_net2 to $int_net1
block in from $int_net2 to $int_net3
block in from $int_net2 to $int_net4

block in from $int_net3 to $int_net1
block in from $int_net3 to $int_net2
block in from $int_net3 to $int_net4

block in from $int_net4 to $int_net1
block in from $int_net4 to $int_net2
block in from $int_net4 to $int_net3

pass in on $int_if1 inet from $int_net1 to ( $ext_if ) modulate state
pass in on $int_if2 inet from $int_net2 to ( $ext_if ) modulate state
pass in on $int_if3 inet from $int_net3 to ( $ext_if ) modulate state
pass in on $int_if4 inet from $int_net4 to ( $ext_if ) modulate state

pass in on $ext_if inet proto tcp from any to ($ext_if) port ssh keep state

pass in on $ext_if inet proto tcp from any to ($ext_if) user proxy keep state


Herrzlichen Dank im Voraus.

 

[Rvg]

the sad old ftp thing

 

[kolvar]

Danke, hab ich gerade gemacht, hat leider nichts gebracht (habe auch die Einstellungen in inetd.conf gecheckt)

sieht jetzt so aus:
ext_if="ep0"
int_if1="rl0"
int_if2="rl1"
int_if3="rl2"
int_if4="rl3"
int_net1="192.168.1.0/24"
int_net2="192.168.2.0/24"
int_net3="192.168.3.0/24"
int_net4="192.168.4.0/24"

scrub in all

nat on $ext_if from 192.168.1.0/24 to ! $int_if1 -> ($ext_if)
nat on $ext_if from 192.168.2.0/24 to ! $int_if2 -> ($ext_if)
nat on $ext_if from 192.168.3.0/24 to ! $int_if3 -> ($ext_if)
nat on $ext_if from 192.168.4.0/24 to ! $int_if4 -> ($ext_if)

nat-anchor "authpf/*"


#rdr pass on $int_if1 proto tcp to port ftp -> 127.0.0.1 port 8021
#rdr pass on $int_if2 proto tcp to port ftp -> 127.0.0.1 port 8021
#rdr pass on $int_if3 proto tcp to port ftp -> 127.0.0.1 port 8021
#rdr pass on $int_if4 proto tcp to port ftp -> 127.0.0.1 port 8021

rdr on $int_if1 proto tcp from any to any port ftp -> 127.0.0.1 port 8021
rdr on $int_if2 proto tcp from any to any port ftp -> 127.0.0.1 port 8021
rdr on $int_if3 proto tcp from any to any port ftp -> 127.0.0.1 port 8021
rdr on $int_if4 proto tcp from any to any port ftp -> 127.0.0.1 port 8021

rdr on $ext_if proto tcp from any to any port 2323 -> 192.168.2.150 port 22
rdr on $ext_if proto tcp from any to any port 2324 -> 192.168.2.4 port 22
#block in log all

block in from $int_net1 to $int_net2
block in from $int_net1 to $int_net3
block in from $int_net1 to $int_net4

block in from $int_net2 to $int_net1
block in from $int_net2 to $int_net3
block in from $int_net2 to $int_net4

block in from $int_net3 to $int_net1
block in from $int_net3 to $int_net2
block in from $int_net3 to $int_net4

block in from $int_net4 to $int_net1
block in from $int_net4 to $int_net2
block in from $int_net4 to $int_net3


pass in on $int_if1 inet from $int_net1 to ( $ext_if ) modulate state
pass in on $int_if2 inet from $int_net2 to ( $ext_if ) modulate state
pass in on $int_if3 inet from $int_net3 to ( $ext_if ) modulate state
pass in on $int_if4 inet from $int_net4 to ( $ext_if ) modulate state


pass in on $ext_if inet proto tcp from port ftp-data to ($ext_if) user proxy flags S/SA keep state

pass in on $ext_if inet proto tcp from any to ($ext_if) port ssh keep state

pass in on $ext_if inet proto tcp from any to ($ext_if) user proxy keep state