Home | History | Annotate | Line # | Download | only in rules 
      1 How to setup FTP proxying using the built in proxy code.
      2 ========================================================
      3 
      4 NOTE: Currently, the built-in FTP proxy is only available for use with NAT
      5       (i.e. only if you're already using "map" rules with ipnat).  It does
      6       support null-NAT mappings, that is, using the proxy without changing
      7       the addresses.
      8 
      9 Lets assume your network diagram looks something like this:
     10 
     11 
     12 [host A]
     13    |a
     14 ---+-------------+----------
     15                  |b
     16              [host B]
     17                  |c
     18 ---+-------------+----------
     19    |d
     20 [host C]
     21 
     22 and IP Filter is running on host B.  If you want to proxy FTP from A to C
     23 then you would do:
     24 
     25 map int-c ipaddr-a/32 -> ip-addr-c-net/32 proxy port ftp ftp/tcp
     26 
     27 int-c = name of "interface c"
     28 ipaddr-a = ip# of interface a
     29 ipaddr-c-net = another ip# on the C-network (usually not the same as the
     30 interface).
     31 
     32 e.g., if host A was 10.1.1.1, host B had two network interfaces ed0 and vx0
     33 which had IP#'s 10.1.1.2 and 203.45.67.89 respectively, and host C was
     34 203.45.67.90, you would do:
     35 
     36 map vx0 10.1.1.1/32 -> 203.45.67.91/32 proxy port ftp ftp/tcp
     37 
     38 where:
     39 ipaddr-a = 10.1.1.1
     40 int-c = vx0
     41 ipaddr-c-net = 203.45.67.91
     42 
     43 The "map" rule for this proxy should precede any other NAT rules you are
     44 using.
     45 
     46