block in log quick on $ext_if from <krfilter> to any block in log quick on $ext_if from any to <krfilter> block out log quick on $ext_if from <krfilter> to any block out log quick on $ext_if from any to <krfilter>
[L1] [L1] Link: OPEN event [L1] LCP: Open event [L1] LCP: state change Initial --> Starting [L1] LCP: LayerStart [L1] can't create tee node at ".:"->"l0": No such file or directory [L1] PPPoE: can't connect "[8]:"->"mpd61269-0" and "[0]:"->"left": No such file or directory [L1] Link: DOWN event [L1] LCP: Down event こんな感じなんですが何が悪いんですかね？設定は上で張られてるmpc.confを参考にしてみたんですが。 どうかお願いいたします。
create bundle static B1 set iface route default set ipcp ranges 0.0.0.0/0 0.0.0.0/0
create link static L1 pppoe set link action bundle B1 set auth authname "" set auth password "" set link max-redial 0 set link mtu 1460 set link keep-alive 10 60 set pppoe iface bge0 set pppoe service "" open
default: load PPPoE_Excite PPPoE_Excite: create bundle template Excite set iface route default set ipcp ranges 0.0.0.0/0 0.0.0.0/0 set iface up-script /usr/local/etc/mpd4/excite.sh set iface mtu 1454 set iface enable tcpmssfix set iface idle 0
create link Excite-link pppoe set auth authname userid@excite.co.jp set link action bundle Excite load client_common client_common: set link no acfcomp protocomp set link disable pap chap set link accept chap set link mtu 1454 set link mru 1454 set link keep-alive 10 60
UPnPはこのようにちゃんと通ってます。 rdr pass on ng0 inet proto udp from any to any port = 5060 label "g101app (192.168.1.197:5060) 5060 UDP" -> 192.168.1.197 port 5060 rdr pass on ng0 inet proto udp from any to any port = 5090 label "g101app (192.168.1.197:5090) 5090 UDP" -> 192.168.1.197 port 5090 rdr pass on ng0 inet proto udp from any to any port = 5091 label "g101app (192.168.1.197:5091) 5091 UDP" -> 192.168.1.197 port 5091
# options set block-policy drop set loginterface $ext_if
# scrub scrub in all scrub out on $ext_if all random-id max-mss 1414
# nat all int -> ext nat on $ext_if from $int_if:network to any -> ($ext_if) rdr pass on $ext_if inet proto udp from any to any port sip -> 192.168.0.230 port sip
>>421 nat on $ext_if proto udp from 192.168.0.230 port sip to any -> ($ext_if) static-port を nat on $ext_if from $int_if:network to any -> ($ext_if) の前に入れてみたら？
PCルーター兼ftpサーバでして、 ext_if="ng0" int_if="em0" ftp_srv="192.168.1.1" nat on $ext_if from $int_net to any -> ($ext_if) nat-anchor "pftpx/*" rdr-anchor "pftpx/*" rdr pass on $ext_if inet proto tcp from any to any port ftp -> 127.0.0.1 port 8021 anchor "pftpx/*" block log all pass quick on lo0 all pass quick on $int_if all という設定（抜粋）で、外から内のftp、内から外のftpに見れるようにはなったんですけど 内から内のftpにつなげなくなりました。
rdr pass on $ext_if inet proto tcp from any to any port ftp -> 127.0.0.1 port 8021 この一文で指定してるのは「外部インターフェイス(ng0)に流れるport21のパケットはproxyにリダイレクトする」という意味ですよね？
リダイレクトを rdr pass on $ext_if inet proto tcp from any to any port ftp -> 127.0.0.1 port 8021 だけに設定した場合。（ローカルから接続不可）
# tcpdump -i em0 port 21 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on em0, link-type EN10MB (Ethernet), capture size 96 bytes 23:31:12.595892 IP 192.168.1.55.1791 > hoge.hoge.jp.ftp: R 2594405633:2594405633(0) ack 394357041 win 0 23:31:12.613883 IP 192.168.1.55.1794 > hoge.hoge.jp.ftp: S 2214447583:2214447583(0) win 65535 <mss 1414,nop,wscale 2,nop,nop,sackOK> 23:31:12.613964 IP hoge.hoge.jp.ftp > 192.168.1.55.1794: S 1331947073:1331947073(0) ack 2214447584 win 65535 <mss 1414,nop,wscale 3,sackOK,eol> 23:31:12.614123 IP 192.168.1.55.1794 > hoge.hoge.jp.ftp: . ack 1 win 65044 23:31:12.638733 IP hoge.hoge.jp.ftp > 192.168.1.55.1794: F 1:1(0) ack 1 win 8307 23:31:12.638990 IP 192.168.1.55.1794 > hoge.hoge.jp.ftp: . ack 2 win 65044 23:31:12.639112 IP 192.168.1.55.1794 > hoge.hoge.jp.ftp: R 1:1(0) ack 2 win 0
442 名前：433 mailto:sage [2008/09/09(火) 17:40:53 ]
リダイレクトを rdr pass on $ext_if inet proto tcp from any to any port ftp -> 127.0.0.1 port 8021 rdr pass on $int_if inet proto tcp from any to $ftp_srv port ftp -> 127.0.0.1 port 8021 の二文を設定した場合。（この場合は接続できています）
# tcpdump -i em0 port 21 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on em0, link-type EN10MB (Ethernet), capture size 96 bytes 23:28:47.060610 IP 192.168.1.55.1791 > hoge.hoge.jp.ftp: S 2594405596:2594405596(0) win 65535 <mss 1414,nop,wscale 2,nop,nop,sackOK> 23:28:47.060686 IP hoge.hoge.jp.ftp > 192.168.1.55.1791: S 394356940:394356940(0) ack 2594405597 win 65535 <mss 1414,nop,wscale 3,sackOK,eol> 23:28:47.060851 IP 192.168.1.55.1791 > hoge.hoge.jp.ftp: . ack 1 win 65044 23:28:47.070117 IP hoge.hoge.jp.ftp > 192.168.1.55.1791: P 1:21(20) ack 1 win 8307 23:28:47.076845 IP 192.168.1.55.1791 > hoge.hoge.jp.ftp: P 1:13(12) ack 21 win 65039 23:28:47.077231 IP hoge.hoge.jp.ftp > 192.168.1.55.1791: P 21:55(34) ack 13 win 8307 23:28:47.082839 IP 192.168.1.55.1791 > hoge.hoge.jp.ftp: P 13:31(18) ack 55 win 65030 23:28:47.091945 IP hoge.hoge.jp.ftp > 192.168.1.55.1791: P 55:78(23) ack 31 win 8307 23:28:47.099456 IP 192.168.1.55.1791 > hoge.hoge.jp.ftp: P 31:37(6) ack 78 win 65024 23:28:47.099858 IP hoge.hoge.jp.ftp > 192.168.1.55.1791: P 78:101(23) ack 37 win 8307 23:28:47.206646 IP 192.168.1.55.1791 > hoge.hoge.jp.ftp: . ack 101 win 65019
set timeout { interval 10, frag 30 } set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 } set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 } set timeout { udp.first 60, udp.single 30, udp.multiple 60 } set timeout { icmp.first 20, icmp.error 10 } set timeout { other.first 60, other.single 30, other.multiple 60 } set timeout { adaptive.start 0, adaptive.end 0 } set limit { states 10000, frags 5000 } set loginterface ng0 set optimization normal set block-policy drop
444 名前：433 mailto:sage [2008/09/09(火) 17:52:29 ]
scrub in on $ext_if all fragment reassemble scrub out on $ext_if all max-mss 1414
nat on $ext_if from $int_net to any -> ($ext_if)
rdr on $ext_if inet proto tcp from any to any port 80 -> $www_srv port 80 rdr on $ext_if proto tcp from any to ($ext_if) port 22 -> ($int_if) port 22 nat-anchor "pftpx/*" rdr-anchor "pftpx/*" rdr pass on $ext_if inet proto tcp from any to any port ftp -> 127.0.0.1 port 8021 rdr pass on $int_if inet proto tcp from any to $ftp_srv port ftp -> 127.0.0.1 port 8021 rdr-anchor "miniupnpd" anchor "miniupnpd" anchor "pftpx/*"
block log all pass quick on lo0 all pass quick on $int_if all pass in quick on $ext_if proto tcp from any to $www_srv port 80 flags S/SA modulate state pass in quick on $ext_if proto tcp from any port > 1023 to ($int_if) port 22 keep state pass in quick on $ext_if inet proto icmp all icmp-type echoreq keep state pass out quick on $ext_if proto { udp, tcp, icmp } from any to any keep state
